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Introduction 


1.1 Overview 


This manual provides a reference guide for all low-level Wind River ICE SX and 
Wind River Probe commands. The commands are listed alphabetically and include 
descriptions, syntax information, and examples. Note that some commands apply 
only to certain emulators; those that are specific to one emulator are so marked, for 
example Wind River ICE SX Only. 


The Wind River ICE SX emulator provides Ethernet support and allows for remote 
operation on any TCP/IP network. Network operation has its own subset of 
commands, which are described in5. Wind River ICE Network Operation Commands. 


Wind River ICE SX and Wind River Probe use a standard ASCII protocol with 
XON/XOFF flow control.There are two 512-character buffers, one for commands 
and the other for responses. A command is not interpreted until a termination 
character is received. At most, only two commands are stored in the character 
buffer at a given time: the command that is executing, and the one that is about to 
be executed. 


Character processing is case insensitive, with the exception of code and data 
symbols. A command name is at least two characters in length. Most commands 
can accept optional arguments or parameters. A space character is used as the 
delimiting character between command names and arguments. 
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Operational Modes 


2.1 The Operational Modes of Wind River Emulators 


Wind River emulators can operate in any one of four main operational modes. 
Each mode is easily identified by the command prompt that is displayed on your 
host or terminal screen. 


Background Mode: >BKM> 


When the >BKM> prompt displays, Background mode is both enabled and active, 
meaning that no code is currently executing and the target is stopped. At the 
prompt, users can enter and execute any valid Wind River low-level commands. 
You can enter Background mode any time you connect to your target, any time you 
use the IN or INN command, or any time you stop your target from running by 
typing Ctrl+C or Ctrl+X. Your target is also placed in Background mode any time 
a software breakpoint is hit. 


Target Running in Real-Time: >RUN> 


The >RUN> prompt only displays after you issue a GO command. The target 
executes application code in Real-Time; Background mode is enabled, but not 
currently active. 


In > RUN > mode, you can enter commands to capture a target snapshot. A 
snapshot is a view of the data on your target retrieved by the debugger by 
instantaneously forcing the target into Background mode and then returning it to 
Real-Time execution. 
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Error Mode: >ERR> 


Error mode occurs when the unit fails to establish debug mode communications. 
There are several possible reasons for this; see the Establishing Communications 
chapter of your emulator’s Hardware Reference for more information. 


Profiling Mode: >PFA> 


The >PFA> profiling prompt indicates that the emulator is profiling your code (the 
performance analysis features are activated with Graphics mode turned off). To 
return to a >BKM> prompt, type Ctrl+C or Ctrl+X. In Profiling mode, you can type 
a DIP command to view the performance data. 


Network Mode: >NET> 


(Wind River ICE SX only) 


The >NET> prompt appears in the Terminal view of Wind River Workbench when 
you have made a serial connection to the Wind River ICE SX,or in a Telnet window 
when you have made a remote connection. Type BKM at the >NET> prompt to 
bring up a >BKM> prompt, and type Ctrl + D to return to the >NET> prompt. 


Low-Level Commands 


3.1 Low-Level Commands 


The following commands are commands that can be used in the OCD Command 
Shell in Wind River Workbench. They are listed alphabetically, and each command 
includes a description, syntax, and example where relevant. 


Most of these commands are valid only at a >BKM> prompt. However, any 
commands that supply version information are also valid at an >ERR> prompt. 


3.1.1 Inline Assembler (ASM) 


Syntax 


Use the ASM command to write to memory using instructions instead of opcode. 


There are three different ways to use this command. Use the first syntax to specify 
the start address and the instruction on the same line. 


ASM start_addr instruction 
start_addr — The address to write to. 
instruction — The instruction used to write to that address. 


Use the second syntax to specify only a start address, and then you are placed into 
ASM mode where you can enter instructions on sequential lines of memory. 


ASM start_addr 


start_addr — The address to begin writing at. 
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The third syntax requires no parameters, and merely places you into ASM mode, 
taking the address of your PC as the start address. 


ASM 
Entering a period (.) at the >ASM> prompt returns you to a >BKM> prompt. 


ASM> . 


Examples 


The first example displays memory at 0 and then uses the first syntax for the ASM 
command. Then the code is disassembled at 0. 

>BKM>dm 0 

00000000: 0000 0000 0000 0000 0000 0000 0000 0000... wee eee eee 
>BKM>asm 0 addi r2,r2,0x1 

>BKM>di 0 1 

$00000000 : 0x38420001 :ppe addi R2,R2,0x1 

The second example places the emulator into ASM mode, at starting address 20. 
Entering a period (.) at the >ASM> prompt returns you to a >BKM> prompt. Then 
the code is disassembled at 20. 


>BKM>asm 20 


$00000020 : 0x00000000 :ppce dc.1 0x0 ASM> addi r2,r2,0x1 
$00000024 : 0x00000000 :ppc dc.1 0x0 ASM> 

>BKM>di 20 1 

$00000020 : 0x38420001 :ppc addi R2,R2,0x1 

>BKM> 


The third example places the emulator into ASM mode, taking the current address 
of the PC as the starting address. The code is then disassembled at the starting 
address of the PC, in this case 50. 


>BKM>asm 

$00000050 : 0x00000000 :ppc dc.1 0x0 ASM> addi 
r2,r2,0x1 

$00000054 : 0x00000000 :ppce dc.1 0x0 ASM> 
>BKM>di 50 1 

$00000050 : 0x38420001 :ppc addi R2,R2,0x1 

>BKM> 


See also the DM (Display Memory) and DI (Disassemble) commands. 


3.1.2 Boot Line Parameters (BL) 


The Boot Line (BL) commands are used to set Linux structures and registers. There 
are several BL commands with various functions, as described below. 


3 Low-Level Commands 
3.1 Low-Level Commands 


NOTE: To use the BL commands you must have both the CF BL and CF MMU 
options set to ENABLE. 


BL ADD REGISTER 


Syntax: 


This command will enter and present a menu prompting for additional entries for 
items to be added into the REGISTER table held in NVRAM. Sequentially, each 
entry field will be prompted with the current contents. A new value may be 
entered. An RTN/ENTER will keep the existing value and advance to the next field. 
To exit the menu, type a period. 


Information can be added to the BL ADD REGISTER command to add a new item 
at the end of the REGISTER table without going through the menu: 


BL ADD REGISTER description type value 
description is an ASCII string representing the name of the entry. 
type should be left blank. REGISTER table entries have UINT32 type by default. 


value is an ASCII string containing a Hex value or a string that is resolved and 
loaded dynamically. 


Example: 


>BKM>BL ADD REGISTER R6 E(R3) + S(0:19) + S(1) 


R6 is the CPU Register selected; E(R3) stands for the value of the entry called R3 in 
the REGISTER table; S(0:19) is the sum of the sizes of entries 0 through 19 in the 
STRUCTURE table; and S(1) is the size of entry 1 in the STRUCTURE table. 


All these arguments must be valid. That is, if there is no entry called R3 in the 
REGISTER table, the BL ADD REGISTER command will abort and return a syntax 
error. 


BL ADD STRUCTURE 


This command will enter and present a menu prompting for additional entries for 
items to be added into the STRUCTURE table held in NVRAM. Sequentially, each 
entry field will be prompted with the current contents. A new value may be 
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entered. An RTN/ENTER will keep the existing value and advance to the next field. 
To exit the menu, type a period. 


Information can be added to the BL ADD STRUCTURE command to add a new 
item at the end of the STRUCTURE table without going through the menu: 


BL ADD STRUCTURE description type value 


description is an ASCII string representing the name of the entry. 
type can be U32 for UINT32, U16 for UINT16, U8 for UINT8, and char for CHAR. 


value--the entered value must comply with the specified type. 


Example: 


BL DELETE 


Syntax: 


BL DISPLAY 


Syntax: 


>BKM>BL ADD STRUCTURE MemSize U32 0x04000000 


Use this command to delete the REGISTER and STRUCTURE tables held in 
NVRAM. 


BL DELETE [REGISTER, STRUCTURE | 


Entering BL DELETE without specifying a table will delete both tables. 


Use this command to display the REGISTER and STRUCTURE tables held in 
NVRAM. 


BL DISPLAY [REGISTER,STRUCTURE] 


Entering BL DISPLAY without specifying a table will display both tables. 


BL INIT 


BL MODIFY 


Syntax: 


BL UPLOAD 


Syntax: 


3 Low-Level Commands 
3.1 Low-Level Commands 


This command will load the BL parameters into target memory and registers 
without performing an IN command. This is useful in cases where the bootROM is 
run to initialize the target board and the emulator is used to establish the boot line 
parameters. 


This command will display and prompt to modify the field contained in the 
specified entry item. Menus are similar to the ADD command menus. Press ENTER 
to go on to the next menu item without modifying the current value. Type a period 
(.) to exit. 


BL MODIFY [REGISTER, STRUCTURE] entryIndex 


Use this command to upload and display the STRUCTURE and REGISTER tables 
held in NVRAM in playback-command format. This enables the user to cut and 
paste into a host-resident file for later playback as an emulator command-script 
file. This same file can be concatenated with the typical target initialization register 
file normally used to set up the primitives of the target. 


BL UPLOAD [REGISTER, STRUCTURE] 


Entering BL UPLOAD without specifying a table will upload and display both 
tables. 


3.1.3 Breakpoint Disable (BD) 


This command disables all or one of the currently enabled software breakpoints. If 
a breakpoint is disabled, it is not installed in target memory prior to execution. 
Using the BD command allows the emulator to remember the breakpoint for future 
use, unlike the RB (remove breakpoint) command, which deletes the breakpoint 
entirely. 


Wind River Workbench 
Command Reference , 2.6.1 


Syntax 
BD address 


address — The address where the breakpoint is installed. Use the DB command to 
display the address. Previously defined symbol names are allowed for address. If 
address is not specified, the BD command will disable ALL breakpoints. 


Example 


The following example disables a breakpoint at address EA0000. First, display all 
breakpoints, including the current status. Then disable the breakpoint. Finally, 
verify the status of the breakpoint by issuing a DB command. Notice the status 
change of the cmp flags. 


>BKM>DB 

1. O0EHa0000 data mask = O00ff cmp_flags = enabled Word_cmp_BEQ 
>BKM>BD EA0000 

>BKM>DB 

1. OEAO000 data mask = OO00ff cmp_flags = disabled Word_cmp_BEQ 
>BKM> 


Refer to SB (set breakpoint) command and DB (display breakpoints) command for 
information on those commands. 


3.1.4 Breakpoint Enable (BE) 
This command enables all or one of the currently disabled software breakpoints. 


Syntax 
BE address 


address — This is the address where the breakpoint is installed (use the DB 
command to display the address). Previously defined symbol names are allowed 
for address. If address is not specified, the BEcommand will enable all breakpoints. 


Example 


For this example, enable the breakpoint at address EA0000, which was previously 
disabled. First, display all breakpoints and their status. Then enable the 
breakpoint. Finally verify the status of the breakpoint by issuing a DB command. 
Notice the status change of the cmp_flags. 

>BKM>DB 

1. OEAO000 data mask = OO00ff cmp_flags = disabled Word_cmp_BEQ 


>BKM>BE EA0000 
>BKM>DB 


3 Low-Level Commands 
3.1 Low-Level Commands 


1. OEA0O000 data mask = O00ff cmp_flags = enabled Word_cmp_BEQ 
BKM> 


See the SB (set breakpoint) command and the DB (display breakpoints) command 
for more information. Es 
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3.1.5 Block Fill (BF) 


Syntax 


This command fills a block of units from start_addr to end_addr with data. 


BFunit start_addr end_addr data 


unit — This can be either B (byte), W (word), or L (long). If no unit is specified, the 
default is W (word). 


start_addr — This is the address at which to begin filling. 
end_addr — This is the end of the address range to fill. 
data — This is a data pattern to be placed into the block range specified. 


start_addr and end_addr can be previously defined symbols. 


Example 1 


In this example, fill a block of memory, 32 bytes (20 Hex) in length with a word of 
data = 4121. First, display memory contents. Then fill the block and verify the 
command. 


BKM>DM 1000 20 

001000 0000 0000 0000 0000 0000 0000 0000 0000 ...............0.00.. 
001010 0000 0000 0000 0000 0000 0000 0000 0000 ...............0.0... 
>BKM>BF 1000 1020 4121 

>BKM>DM 1000 20 

001000 4121 4121 4121 4121 4121 4121 4121 4121 .................... 
001010 4121 4121 4121 4121 4121 4121 4121 4121 .................... 
>BKM> 


Example 2 


In this example, change the command unit size from the last example of a word to 
a size L (long): 


>BKM>DM 1000 20 

001000 0000 0000 0000 0000 0000 0000 0000 0000 ................0... 
001010 0000 0000 0000 0000 0000 0000 0000 0000 .................... 
>BKM>BFL 1000 1020 4121 

>BKM>DM 1000 20 
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001000 0000 4121 0000 4121 0000 4121 0000 4121 ..A!..A!..A!..A!..A! 
001010 0000 4121 0000 4121 0000 4121 0000 4121 ..A!..A!..A!..A!..A! 
BKM> 


See also the information provided on the DM (display memory) command. 


3.1.6 Block Move (BM) 


The BM command copies blocks of data from one address to another. 


Syntax 
BMunit source_start_addr source_end_addr dest_start_addr 


unit — This can be either B (byte), W (word), or L (long.) By default it is set to W 
(word). 


source_start_addr — Start address of the memory to move. 
source_end_addr — End address of memory to move. 
dest_start_addr — Start address of the location where the memory is moving to. 


Previously defined symbols can be used for any of the above addresses. 


Example 


In this example, move a 32 byte (20 Hex) block from one area of memory to another. 
Memory is displayed before and after the move. 


>BKM>DM 1000 20 


001000 5448 4953 2049 5320 4120 5445 5354 2121 THIS IS A TEST!! 
001010 0000 0000 0000 0000 0000 0000 0000 0000 ................ 
BKM>BM 1000 1010 1010 

BKM>DM 1000 20 


001000 5448 4953 2049 5320 4120 5445 5354 2121 THIS IS A TEST!! 
001010 5448 4953 2049 5320 4120 5445 5354 2121 THIS IS A TEST!! 
BKM> 


See also DM (display memory) command. 
3.1.7 Cache Access Command (CA) 


The Cache Access (CA) commands are used to view and alter the state of the 
Instruction and Data caches of the processors. Note that certain CA commands are 
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CA dis 


3 Low-Level Commands 
3.1 Low-Level Commands 


processor specific, as indicated in the command descriptions. There are several CA 
commands with various functions, as described in the sections that follow. 


Syntax 


CA 


Issuing the CA command without any arguments lists all of the Cache Access 
commands and their syntax. 


Example 


>BKM>ca 


CA 
CA 
CA 


CA 


CA 


CA 
CA 
CA 
CA 
CA 
CA 
CA 
CA 


sw 


dis 

dump 
dump 
dump 
dump 


dump 
read 


search <addr..addr> <sw> 


<Sw> 
<addr> <sw> 


<addr> -il 


<addr> -dl 


<addr> -11 
<Sw> 


enable <sw> 
disable <sw> 
inv <sw> 


-s 
diff 


-d data, 


<Ssw> 


-i instruction cac 


WAYs. 


he only, 


Display true target 
directly. 
Display true target 
directly. 
Display true target 
Display VALID cache 
Searches for <addr> 
Enables both or just I or D caches. 

Disables both or just I or D caches. 
Invalidate both or just I or D caches. 
Display the state for both caches. 

Display differences between Cache and memory. 


Disassemble all VALID I cache data. 
Display ALL cache sets for I, D or L caches. 
Display the appropriate cache SET for all 


i-cache tags and data 
d-cache tags and data 
L2-cache tags directly. 


sets for I, D or L caches. 
in the I, D or L caches. 


-l1 L2 cache, -13 L3 cache>BKM> 


The CA commands that appear above are described in the following sections. 


This command displays all valid lines in the instruction cache in a disassembly 
format. The example displays all the cache information related to where this data 
was obtained from in the cache, and what the instructions are for each line. 


Example: 


>BKM>ca dis 
WayO Set 000 $00005000 
[V,LRU 4] $00005004 


$00005008 
$0000500c 
$00005010 
$00005014 
$00005018 


2 0 


0x48000005 
x7C6802A6 

0x3C801122 
0x60843344 
0x90830040 
0xB0830050 
0x98830060 


:ppc 


bl 


:ppc mflr 


:ppc 
:ppc 
:ppc 
:ppc 
:ppc 


lis 
ori 
stw 
sth 
stb 


0x5004 
R3 

R4,0x1122 
R4,R4,0x3344 
R4, 0x40 (R3) 
R4, 0x50 (R3) 
R4, 0x60 (R3) 
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$0000501c 0x80A30040 :ppc lwz R5, 0x40 (R3) 
Way0 Set 001 $00005020 0xA0A30050 :ppc lhz R5,0x50(R3) 
[V,LRU 4] $00005024 : 0x88A30060 :ppc lbz R5, 0x60 (R3) 
$00005028 : Ox7CO004AC :ppc sync 
$0000502c Ox4BFFFFD4 :ppc b 0x5000 
$00005030 0x80020010 :ppc lwz RO, 0x10 (R2) 
$00005034 0x80000000 :ppc lwz RO, 0x0 (RO) 
$00005038 0x80010000 :ppc lwz RO, 0x0 (R1) 
$0000503c 0x80081082 :ppc lwz RO, 0x1082 (R8) 


CA dump -i 


This command displays all of the processor instruction cache lines regardless of the 
state of each line. This example shows a processor with an instruction cache 
structure that has 5 WAYS and 128 sets per WAY. The entry at way0/set0 is marked 
as valid with the /v flag, and all other entries are marked as invalid /i. 


Example: 


>BKM>CA dump -i 


CA dump -d 


Set 
000 
001 
002 
003 
004 
005 
006 
etc 
126 
127 


Way0 
0x00005000/v 
OxFFFFF020/i 
OxAAFE9040/i 
OxCC7EC060/i 
0xD91BB080/i 
0xD27950A0/i 
0x3BB400C0/i 
0xD27950A0/i 
0x3BB400C0/i 


>BKM> 


Wayl 
0x3C332000/i 
OxFFFFF020/i 
0x5BC1D040/i 
0x2D662060/i 
0x5A2AB080/i 
0x98COEOA0/i 
0x347A20C0/i 


0x9 8COEOA0/i 
0x347A20C0/i 


Way2 
0x57FFBO000/i 
OxFFFFF020/i 
0x5213E040/i 
0x952F6060/i 
0x6BDE3080/i 
Ox4E5E00A0/i 
0xA36180C0/i 


Ox4E5E00A0/i 
0xA36180C0/i 


Way3 
OxB24FC000/i 
Ox1DAF8020/i 
0x53788040/i 
0x1BB7D060/i 
OxED2A2080/i 
0x094B40A0/i 
0xA23300C0/i 


0x094B40A0/i 
0xA23300C0/i 


Way4 
OxDEE20000/i 
OxE7B28020/i 
0xC875D040/i 
0x18093060/i 
0x51E43080/i 
0x3A5290A0/i 
0x5099A0C0/i 


0x3A5290A0/i 
0x5099A0C0/i 


This command displays all of the processor data cache lines regardless of the state 
of each line. This example shows a processor with a data cache structure that has 4 
WAYS and 128 sets per WAY. The entry at way0/set2 and set3 are marked as valid 
with the /v flag, and all other entries are marked as invalid /i. There is a second 
flag associated with the data cache. This flag indicates if the data is dirty (most 
recent) or clean (same as memory). If the entry is marked as clean with the /c flag, 
then contents in the cache and the contents in memory are the same. If the entry is 
valid and it is marked as dirty with a /d flag, then the data in the cache is the most 
recently used data and the value in memory is no longer valid. 
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Example: 


>BKM>CA dump -d 


Set 
000 
001 
002 
003 
004 
005 
006 
etc 
125 
126 
127 


CA dump addr -il 


Way0 
OxE17AF000/i/c 
OxBAF43020/i/c 
0x00005040/v/d 
0x00005060/v/d 
0xCA098080/i/d 
OxEF70OFOA0/i/c 
OxF9D5D0C0/i/d 


Wayl 
0x80517000/i/d 
0x56560020/i/d 
0x79F9BO040/i/c 
Ox2F6B2060/i/c 
0x7CD4C080/i/c 
Ox1AF4BO0A0/i/c 
0x458F20C0/i/d 


3 Low-Level Commands 
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Way2 
OxCEF44000/i/c 
0x384A2020/i/c 
OxCB2BC040/i/d 
OxED936060/i/d 
0xC3BAD080/i/d 
0x1016A0A0/i/d 
OxAF17F0CO/i/c 


Way3 
0x37ECBO000/i/d 
0x0A27A020/i/d 
0x80A73040/i/c 
0x58252060/i/c 
0x63B2C080/i/c 
0x525E00A0/i/c 
OxAE8B70C0/i/c 


OxE9 4B6F! 


0xD27DFFA0/i/d 
Ox58FO00FCO/i/c 


OxD8C3FFA0/i/d 
OxC5AE3FCO/i/d 
Ox3CECFFEO/i/d 


Ox1 
0x45 


E0/i/d 


D8B9FA0/i/c 
12CFCO/i/c 
Ox6EE65FE0/i/c 


0x7B3D3FA0/i/d 
Ox9B7ACFCO/i/c 
OxC14DDFE0/i/d 


This command displays all of the possible ways that a specified address could be 
found in the instruction cache. The -il switch is used to indicate a long format for 
the instruction cache. This example shows all WAYS for set0. The address TAG of 
0x5000 is marked as valid, and all other ways are marked as invalid. 


Example: 

Figure 3-1 CA dump 5000 -il 
‘Tasks | Problems | Properties | Build Console | Error eer} sf OCD Command Shell. x > m| a | a /|@| — 7 
[Connected to PPC750Fx] 
| a 
|>BKM>ca dump 5000 -il 
Set 000 Way O I 7 OxCFBDFOOO OxF4FSCF3B OxF7S59FF14 Ox399F67FA Ox795CA53D Ox7563B3BA OxFD3FCSDO Ox 
Set O00 Way 1 I 7 OxAFZ2DFO00 OxD798COBA Ox7E479959 Ox11BSFDES OxD32F57FA OxEFDBE72D OxOB2FFF7F Ox 
Set 000 Way 2 I 7 Ox39BFEO000 OxB36BE94D Ox65F9OF7A3 OxBDSFVE6F OxF6DE5531 Ox97FD2731 OxFEIFC6DB Ox 
Set 000 Way 3 I 7 OxFFS97000 OxB665F677 Ox475S8EDEB OxCF49377F Ox77ESADSA Ox6D47FBF8 OxCDE1DEBD Ox 
Set 000 Way 4 I 7 OxBF3EEQ00 OxFASFFAD1 Ox43BE2F96 OxFC37D597 OxD3DFEC78 Ox1AES6F93 OxAE7B265C Ox 
Set O00 Way 5 I 7 OxCFB6EO000 Ox9739EB4B Ox763A54F3 OxCEFEDFD7 OxSFEEE1EA OxEEDBF7E7 OxDB7BFS34 Ox 
‘Set OOO Way 6 I 7 OxSSBSAOOO OxFDF6FS3E OxF1FDSFAO OxDBD629DD OxBBSSBD69 Ox387BFS3E Ox7BB47F7E Ox 
Set O00 Way 7 I 7 Ox77B37000 Ox246BF4BB Ox26CA7BFB OxE7F74458 Ox6A7AFC6A Ox749C4192 OxCEDBBF4D Ox 
|>BKuD| 
EE Pia 


CA dump addr -dl 


This command displays all of the possible WAYS where a specified address could 
be found in the data cache. The -d1 switch is used to indicate a long format for the 
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data cache. This example shows all 8 WAYS for set2. The address TAG of 0x5040 is 
marked as valid, and all other WAYS are marked as invalid. 


Example: 


Figure 3-2 CA dump 5040 -dl 


“Tasks | Problems | Properties | Build Console|Errortog ete ee eS > | a me] a | G 


[Connected to PPC750FX] 


a 


koxes dump 5040 -dl 


‘Set 002 Way 


OIC 7? Ox?2DF3040 OxD9C74D98 Ox17FFFEA1 Ox9572D33E OxE94942D0 Ox1FEF?7797 OxED6E3E6a 
‘Set 002 Way 1 I C 7 OxE3EFCO40 Ox53E4B7E4 OxABEO14E0 Ox7BFOFFSA OxE1E737A7 OxBCOD21FD OxFE1BF7FO 
Iset 002 Way 2 I C 7 Ox54B3E040 Ox3DDFS6SF OxBFESOE6E Ox6BD9277E OxFEF?F7EB OxDD6EA63E OxS1FEFSD9 
lset o02 Way 3 I C 7? Ox3577E040 OxE376AaBEF Ox1FDA7769 OxBEAEFC3F OxSC7B6FB7 Ox6SBOFBED OxBEB?DFAF 
lset 002 Way 4 I C 7 OxDFD7FO40 OxE4F9FFO6 OxBASSFBF1 Ox96S56D797 OxF3D9EEF3 OxFB196DBB OxB659739C 
let 002 Way S I C 7 OxFSFDEO40 Ox62DB2743 Ox67B1373E OxF797EDA3 OxAFCSEF39 OxEQASFE2F Ox6F898D73 
\Set 002 Way 6 IC 7 OxAa6D85040 OxE32F7171 Ox?7BSE343 OxFFFSBD76 OxBF67F613 Ox4FF5726S5 Oxa3F69SBC 
lSet 002 Way 7 I C 7 OxBDCFFO40 OxO6E49DE8 Ox9AC37F3D OxF219B57B 0x37566447 OxEFSBF44a OxESDEE4EB 


>BKHD| 


F - 


CA read -i 


This command displays only the processor instruction cache lines that are valid. 
This example shows that TAG address 0x5000 from way0/set0 is the only valid 
entry found. The LRU flag indicates the Least Recently Used WAY is way0. 


Example: 


>BKM>ca read -i 

Set/Way Tag 

000/000 0x00005000/lru 0 
CA read -d 


This command displays only the processor data cache lines that are valid. This 
example shows that TAG address 0x5040 and 0x5060 are the only valid entries 


found. 

>BKM>CA read -d 

Set/Way Tag[status]: Data+0 Datat+4 Data+8 Data+C Data+10 
Data+14 Data+18 Data+1C 


002/000 0x00005040[d]:0x80001000 0x11223344 0x00000400 0x00000402 0x08004000 
0x33440000 0x00080080 0x00000000 

003/000 0x00005060[d]:0x00001000 0x44000C02 0x00100400 0x00000000 0x08000000 
0x00000000 0x00400000 0x00000010 

>BKM> 
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CA search start_addr..end_addr -i 


This command searches the instruction cache for valid cache lines. The command 
expects a starting and ending range. The example shows a search of the instruction 
cache starting from address 0x5000 to 0x6000, and has found 2 valid cache lines 
within this address range. 


>BKM>CA search 5000..6000 -i 
Set/Way Tag 

008/000 0x00005100 

009/000 0x00005120 

>BKM> 


CA search start_addr..end_addr -d 


CA-s 


CA diff -i 


This command searches the data cache for valid cache lines. The command expects 
a starting and ending range. This example shows a search of the data cache starting 
from address 0x5000 to 0x6000, and has found 2 valid cache lines within this 
address range. 


>BKM>ca search 5000..6000 -d 
Set /Way Tag 

010/000 0x00005140 

011/000 0x00005160 

>BKM> 


This command displays the state of each cache. L2 and L3 caches are level 2 and 3 
caches found in the high end PowerPC processors. 


>BKM>ca -s 
Instruction Cache: Enabled 


Data Cache : Enabled 
L2 Cache : Disabled 
L3 Cache : Disabled 
>BKM> 


This command displays all differences between the instruction cache and main 
memory for all valid cache lines. This example displays one cache line where the 
top values are the cache values, and the bottom values are main memory content. 
The dash lines indicate that there were no differences found. 
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>BKM>CA diff -i 

Set/Way Tag Tag+00 Tag+04 Tag+08 Tag+0C 
Tag+10 Tag+14 Tag+18 Tag+1c 

001/000 0x00005020 OxA0A30050 O0x88A30060 Ox7CO004AC Ox4BFFFFD4 
0x80020010 0x80000000 0x80010000 0x80081082 

SeSasSe sesh tases aa Sea SSS SSE 0x00020080 0x00000400 
0x00010000 0x00081100 

>BKM> 


This command displays all differences between the data cache and main memory 
for all valid cache lines. This example displays one cache line where the top values 
are the cache values, and the bottom values are main memory content. The dash 
lines indicate that there were no differences found. 


>BKM>CA diff -d 

Set/Way Tag Tag+00 Tag+04 Tag+08 Tag+0C Tag+10 
Tagt+14 Tagt+18 Tag+1Cc 

002/000 0x00005040 0x80001000 0x11223344 0x00000400 0x00000402 
0x08004000 0x33440000 0x00080080 0x00000000 

FSS SSeS QOxAABBCCDD 0x00000000 O0x00000000 OXFFFFFFFE OxXxFFFFFFFE 
Ox001L00T00) saeersesse 

>BKM 


3.1.8 Configure Parameters (CF) 


The CF command is a low-level ASCII command that configures important 
emulator and system-level parameters. The CF parameter table remains set until 
modified with subsequent CF commands. 


For any given processor, entering a CF command without parameters at any 
>BKM> prompt will list all of the executable CF options for the processor type you 
are using. The following example shows available CF command options and 
parameters for an MPC 8260 board. 


To make a change to any of these values, type CF and the CF command option you 
wish to modify, followed by the specific parameter you wish to configure, all on 
the same command line. 


For example, to configure your system for a MPC8245 target, you would type 
BKM>CF TAR 8245 


You can use the CF command from the > BKM > or >ERR> prompt, but not from 
either a > RUN > or a >TRC> prompt. 
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Although the options vary depending on your target architecture, typing CF at the 
>BKM> prompt will provide a list of the options that are available for your target. 


3 Low-Level Commands 
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Figure 3-3 CF Options View 
Tasks | Problems | Properties | Build Console | Error Log | G3lcr options >. Wea Command Shell ee le 
‘CF Options - [ connected ] 
[Command Name [Current setting [Parameters | Description 
SB SB ‘SB, IHBC] Set BreakPoint 
VECTOR Low [HIGH, LOW, IGNORE] Vector Table Location 
RST YES [YES, NO, HALT, RUN] Monitor Target reset 
TAR 750FX [AUTO, 603E, EC603E, 603P, 603R... Target CPU 
SLAVE NONE [NONE, 8260] Target CPU SLAVE } 
SLIMMRVAL AUTO [AUTO, VALUE] Slave IMMR reset value 
CLK 16 0.025,.,100, AUTO] JTAG clock rate (MHz) 
RTP NO (YES, NO] Real time Preservation 
LENDIAN NO [YES, NO] Little Endian Mode 
MODE 64 32, 64] Processor Mode 
DLD NORMAL NORMAL, 8] Download Mode 
HRESET ENABLE [ENABLE, DISABLE] Emulator HRESET Control 
PAR NO YES, NO] Data Parity Checking 
TGTCONS BDM BDM, COM1, COM2] Target Console Redirection 
TRESET ACTIVE [OPENC, ACTIVE] Drive TReset line 
INYCI YES [YES, NO] Invalidate Instruction Cache on GO 
SPOWER YES YES, NO] Sense Power via HRESET 
RESET HRESET [HRESET, SRESET, HRESET_UNFIL... CPU Reset Type 
TRPEXP YES [YES, NO, SOI, BREAKPOINTONLY] Trap exception 
INCOLD YES YES, NO] Issue an IN on coldstart 
L2 WARNING NO [YES, NO] Display L2 Data Cache Warning 
BRKREP BRKREP [REPONLY, BRKREP] Trigger In Report Mode 
TMD DISABLE ENABLE, DISABLE] TMD Mode 
AIMMRER OFF [OFF,START and END] Application IMMR Exclusion Range 
AIMMRVAL Oe000000 [VALUE] Application IMMR. Value 
WSPACE 0000000 FFF BASE and SIZE] Set Work Space 
STACK OFF [OFF / LOWER and UPPER] Set Stack Range 
RPL 1 [1..600] Reset Pulse Length N*ims. 
PONR, 0 [o..500] Power On Reset Length N*ims 
RCL 1000 1000, .FFFF] Runn Counter Length 
DRST 25 [o..100] Delay after Reset Nms 


The CF options that are available vary widely from target to target. For descriptions 
of the CF options for the target architectures that are currently supported by Wind 
River, see the Wind River Workbench On-Chip Debugging Configuration Options 
Reference. 


NOTE: Some of the CF options may be the same from target to target. Be aware, 


however, that there are options that are unique to specific processor families. Be 
sure to refer to the section that is appropriate for the target that you are using. 


3.1.9 Configure Register Groups (CF GRP) 
Use this command to enable or disable register groups. 


Syntax 


cf grp 
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Example 
>BKM>c£ grp 
Group (CF GRP (M/S) Name = ENABLED/DISABLED 
SYS-CFG (O=Disable 1=Enable) Enabled > 


The name of the first register group is displayed, along with its current status 
(either ENABLED or DISABLED). 


Type 0 to disable the group or 1 to enable it. 


To leave the setting as it is and advance to the next register group, press the ENTER 
key without typing 0 or 1. Continue through the list of register groups enabling 
and disabling them as required. 


When all register groups are enabled or disabled, type CF UPLOAD GROUP at the 
>BKM> prompt. This displays a list of all of the register groups on your target with 
their current settings as shown below: 


>BKM>cf£ upload group 


CF GRP SYS-CFG ENABLED ; GROUP 
CF GRP INTO ENABLED ; GROUP 
CF GRP INT1 ENABLED ; GROUP 
CF GRP GLOBAL_ACK ENABLED ; GROUP 
CF GRP CSO-5 ENABLED ; GROUP 
CF GRP SDRAM ENABLED ; GROUP 
CF GRP REAL_TIME CLOCK DISABLED ; GROUP 
CF GRP PINT_TIMERS DISABLED ; GROUP 
CF GRP DMA_TIMERS DISABLED ; GROUP 
CF GRP PWM DISABLED ; GROUP 
CF GRP EDMA_CTRL DISABLED ; GROUP 
CF GRP EDMA_CHANO-3 DISABLED ; GROUP 
CF GRP EDMA_CHAN4-7 DISABLED ; GROUP 
CF GRP EDMA_CHAN8-11 DISABLED ; GROUP 
CF GRP EDMA_CHAN12-15 DISABLED ; GROUP 
>BKM> 


3.1.10 Chip Selects (CS) 


NOTE: This command is processor dependent and not available across all families. 


This command gives you a table-driven method for setting up the chip-selects for 
your processor. This table is stored in non-volatile memory and is automatically 
downloaded to the proper target location (via Background Mode memory sets) 
after every initialization sequence (IN command). To initialize Background Mode 
communications without writing the chip-select table and SIM registers (SC 
commands), use the INN command. 
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Syntax 


CS arg 


3 Low-Level Commands 
3.1 Low-Level Commands 


arg — This is the specific chip-select to modify. 


If no arg is specified, the emulator will present a table of all of the chip selects. 


Example 


When the emulator is configured for an MPC 8260 target, a CS command with no 
arguments will display the following: 


>BKM>cf£ tar 8260 


>BKM>cs 

Name BA AM AT ATM PS PARE WP MS V CSNT/SAM ACS BI SCY SETA TRLX 
CSO FFCOOQ000 FFCO0000 0 0 16 No RW GP Y Normal 1/2 Y 6ws Int. Norm 
CcS1 00000000 00000000 0 O0O 32 No RW GP Y Normal 0 N Ows Int. Norm 
cS2 00000000 FFCO0000 0 0 32 No RW UB YI.M.AMB 0 N Ows Int. Norm 
csS3 00000000 00000000 0 0 32 No RW GP N Normal 0 N Ows Int. Norm 
cs4 00000000 00000000 0 0O 32 No RW GP N Normal 0 N Ows Int. Norm 
cs5 00000000 00000000 0 0O 32 No RW GP N Normal 0 N Ows Int. Norm 
csé 00000000 00000000 0 0O 32 No RW GP N Normal 0 N Ows Int. Norm 
cS7 00000000 00000000 0 0O 32 No RW GP N Normal 0 N Ows Int. Norm 


The above chip-select table shows the factory default settings. To modify any of 
these chip-selects, type the CS command followed by the name of the specific 
chip-select to modify. The emulator displays the following for the CSO example, 
one line at a time, which shows you the options and current settings, and then 
prompts you to make individual changes. 


>BKM>cs cs0 
00000000 -> FFFF8000 
00000000 -> FFFF8000 
0 -> 7 
0 -> 7 
(0-2)=32, 8, 


0 = Disabled, 1 = Enabled 
0 = Read/Write, 1 = 
(0-3) = 

0 = Not Valid, 1 
(0-3)=Norm, Rsvd, 


= Valid 
1/4 clk, 


16 bits / 3=Rsvd 


Read Only 
GPCM, Rsvd, UPMA, UPMI 


1/2 clk 


B 


Base Register = FFC00000 
Address Mask FFC00000 
Address Type = 0 

Address Type Mask = 0 

Port Size = 16 Bits 

Parity Enable = Disabled 
Write Protect = Read/Write 
Machine Select = GPCM 
Valid state = Valid 
Address/CS Setup = 


1/2 clk 


VVVVVVV VV VY 


After you use the CS command to make a change in the emulator’s chip select 
table, issue an IN command in order to download the table, and thus the changes 


to the target. 
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3.1.11 Chip Selects —Target (CST) 


Syntax 


Figure 3-4 


The CST command is similar to the CS command in that it displays a table of 
chip-selects. The difference is that the CST command provides a snapshot view of 
the chip-selects that are currently set on your target (rather than in the emulator). 
This is a useful command because it allows you to see whether or not your target 
is still synchronized with the chip-select table that you have programmed into 
your emulator. 


If your target is no longer synchronized with your emulator chip-select table, an IN 
command will cause the target chip-select values to be overwritten by the ones 
stored in the emulator. 


cst 


There are no parameters associated with this command. 
Example 


The following example displays a target chip-select table for a Wind River 8260 
reference design. 


Chip Select Table 

Registers | Flash Programming View | Watch #eNeenrier hy tes Local Variables | Hardware Diagnostic View >ae|Aul4a|@lo- 
[Connected to MPC8260] 

>BKM>cst 

Name MS Ba AN UA SA LA V PS DECC WP EMEMC ATOM DR CSNT BANK BI ACS RSA SCY NOR SETA PAGE TRLX INTL EHTH AAC 


cSO GP6é FEOQOOO00 FEOQOO000 
CS$1 GP6 Fcooo000 FFooO0000 
cS2 spé goo000000 -------- 
cS3 SDé 01000000 
C34 SDL 04000000 
cSS GP6 22000000 FFFFOOOO 
C36 GP6 §o000000 FEQO0000 
cS? GP6 21000000 FFFFOOOO 
cs8 GP6 90000000 GcOo000000 
cS9 UPMA 60000000 FFFFOOOO 
C310 UPMB 70000000 FFFFOOOO 
C$11 UPMC 80000000 FFFFOOOO 


OFF RW No Norm No 
OFF RW No Norm No 
OFF RW No Norm No 
OFF RW No Norm No 
OFF RW No Norm No 
OFF RW No Norm No 
OFF RW No Norm No 
OFF RW No Norm No 
OFF RU No Norm No 
OFF RW No Norm No 
OFF RU No Norm No 
OFF RW No Norm No 


--- Int. ---- Rlx. ---- Ext. --- 
--- Int. ---- Norm ---- Norm --- 
---- Non 
---- Non 
---- Non 
Ext. 


See also the information provided on the CS command. 


3.1.12 Display Breakpoint (DB) 


This command displays all software breakpoints and their status. The status 
includes whether the break is enabled or disabled, and the conditions on which to 
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break. For viewing convenience, each breakpoint is assigned a number. In 
addition, after a breakpoint has occurred, a flag indicates which breakpoint has 
interrupted code execution. 


Syntax 


DB 


Response: addr break_conditions status 
addr — the address at which the breakpoint is set 


break_conditions — conditional information that can be set using the SB command 
(such as running through code count number of times before hitting the 
breakpoint) 


status — states whether the breakpoint is enabled or disabled 


Example 


>BKM>db 
Software Code Breakpoints 
1. 00040418 count = 0001 actual = 0000 enabled 
2. 0004042C count = 0001 actual = 0000 enabled 
e| 0004044C count = 0001 actual = 0000 enabled 
4. 00040494 count = 0001 actual = 0000 enabled 
!INFO! - [msg82001] No internal hardware breakpoints installed 
>BKM> 


See also the SB (Set Breakpoint) command for more information. 


3.1.13 Display Configuration (DC) 


This command displays the current hardware and firmware levels that your 
emulator is using. 


Syntax 


pc 


Example 


>BKM>de 

Firm Rev = vn1l.0m 

UJD Rev = 1.0h 

PDI Version 1.1 WIND POWER ICE PPC82XX (type = 0x30) 
>BKM> 
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3.1.14 Diagnostic Function (DF) 


This command runs a pre-written emulator diagnostic function. This section 
describes the build-in diagnostic functions supported by the emulator which are 
run from a >BKM> prompt, using the low-level command language built in to the 
emulator, rather than using a graphical user interface. Their primary function is to 
expose memory problems, both in RAM and ROM, as well as any download 
problems. 


The following pages serve as a reference for the available diagnostics, all of which 
are accessed with the same command prefix: 


DF Diagnostic_Function_Code 


For greater detail on the functions performed by each test, type HE DF 
Diagnostic_Function_Code at the >BKM> prompt in the OCD Command Shell. 


Simple RAM Test: Single Pass — DF 0 Command 
The DF 0 command runs a simple RAM test for a single pass. 


Syntax 


DFunits 0 args 


units — The units can be either B (byte), W (word), or L (long). By default, this 
parameter is set to Word. 


args — This is an address range, spanning from begin_addr to end_addr. 


Example 1 


A simple RAM test is executed on a 128 word memory space. There will be no 
errors. 


>BKM>DFW 0 00000 OOOFF 
simple ram test running 
test complete 

>BKM> 


Example 2 


A simple RAM test is executed on a 128 word memory space. There will be a bad 
memory bit 12 at address OOOOE. A bit will be stuck low. 


>BKM>DFW 0 00000 OOOFF 
memory failure: SOQ000E=$4555 not $5555 complete 
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Simple RAM Test: Continuous — DF1 Command 


The DF 1 command runs a simple RAM test continuously. This test can be stopped 
by typing Ctrl+C. EZ 
3 
Syntax 


DFunits 1 args 


units — These can be either B (Byte), L (Long), or W (Word). By default, this 
parameter is set to Word. 


args — This parameter requires an address range from begin_addr to end_addr. 


Example 1 


A simple RAM Test is executed continuously on a 128 word memory space. There 
are no errors. 
>BKM>DFW 1 00000 OO0FF 


!ABORT! - [msg72000] User Command Abort 
>BKM> 


Example 2 


A simple RAM test is executed continuously on a 128 word memory space. There 
is a bad memory bit 12 at address O000E. A bit is stuck low. 


>BKM>DFW 1 00000 OOOFF 


memory failure: S$0000E=$4555 not $5555 
PASS# = 1 
memory failure: S$0000E=$4555 not $5555 
PASS# = 2 
UNTIL *C 


Complete RAM Test: Single Pass — DF 2 Command 
The DF 2 command runs a complete RAM Test for a single pass. 


Syntax 
DFunits 2 args 


units — This parameter can be either B (Byte), W (Word), or L (Long). By default, it 
is set to Word. 


args — This is an address range that is specified from begin_addr to end_addr. 
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Example 1 


A complete RAM test is executed on a 128 word memory space. There are no 
errors. 


>BKM>DFW 2 00000 OOOFF 
complete ram test running 
test complete 

>BKM> 


Example 2 


A complete RAM test is executed on a 128 word memory space. There is a bad 
memory bit 12 at address OOOOE. A bit is stuck low. 


BKM>DFW 2 00000 OOOFF 

memory failure: SOQ000E=Sefff not Sffff memory failure: 
SOO00E-$0000 not $1000 

complete 

BKM> 


Complete RAM Test: Continuous — DF 3 Command 


Syntax 


The DF 3 command runs a complete RAM test continuously. This test can be 
stopped by typing Ctrl+C. 


DFunits 3 args 
units — This parameter can be either B (byte), W (word), or L (long). 


args — This is an address range, specified from begin_addr to end_addr 


Example 1 


A complete RAM test is executed continuously on a 128 word memory space. 
There are no errors. 


>BKM>DFW 3 00000 OOOFF 
complete ram test running 
>BKM> 


Example 2 


A complete RAM test is executed on a 128 word memory space. There is a bad 
memory bit 12 at address OOOOE. A bit is stuck low. 


>BKM>DFB 3 00000 OOOFF 
complete ram test running 
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memory failure: $0000F=Sef not Sff memory failure: 
SOO000F=$00 not $10 

PASS# = 1 

memory failure: $0000F=Sef not Sff memory failure: 
SOO000F=$00 not $10 

PASS# = 2 


UNTIL “C 


CRC Test — DF 4 Command 


Syntax 


The DF 4 command runs a CRC Test over a specified range of memory. 


DF 4 args 

args — An address range, specified from begin_addr to end_addr. 
Example 

A CRC Test is executed on a 128 word memory space. 

>BKM>df 4 00000 OO0OFF 

CRC-16 test running 


Completed... CRC-16 Value = 166D 
>BKM> 


Scope Loop: Read from Location — DF 5 Command 


Syntax 


The scope loop routines are useful when troubleshooting with an oscilloscope. 
Read/write continuously from/to an address and Write Then Read data are 
supported routines. 


The DF 5command consecutively reads from the specified address. This test can be 
stopped by typing Ctrl+X. 


DFunit 5 args 
unit — This parameter can be either B (byte), W (word), or L (long) 


args — This specifies a base address base_addr. 
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Example 


Scope Loop reading a location. 
>BKM>df 5 £800000 


DF 5 reading a location press *X to abort 
>BKM> 


Scope Loop: Write to Location — DF 6 Command 
The DF 6 command consecutively writes a specified pattern to the address 
specified. This test can be stopped by typing Ctrl+X. 
Syntax 
DFunit 6 args 
unit — This parameter can be either B (byte), W (word), or L (long). 
args — This parameter consists of a base address base_addr and a hex string 
hex_string. 
Example 


Scope loop writing data to a location. 
>BKM>df 6 e800000 5555 


DF 6 Writing a location press *X to abort 
>BKM> 


Scope Loop: Write and Complement — DF 7 Command 


The DF 7 command consecutively writes a pattern to the address specified and 
then writes its complement. This test can be stopped by typing Ctrl+X. 

Syntax 
DFunit 7 args 


unit — This parameter can be either B (byte), W (word), or L (long). 


args — This parameter consists of a base address base_addr and a hex string 
hex_string. 


Example 


Scope loop writing data then its complement to a location. 
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>BKM>DF 7 £80000 5555 
DF 7 writing value then complementing press *x to abort 
>BKM> 


Scope Loop: Write Rotating Value — DF 8 Command 


Syntax 


The DF 8 command writes a pattern to the address specified and rotates the 
pattern. The test can be stopped by typing Ctrl+X. 


DFunit 8 args 
unit — This parameter can be either B (byte), W (word), or L (long). 


args — This parameter consists of a base address base_addr and a hex string 
hex_string 


Example 


Scope Loop writing rotating data to a location. 


>BKM>d£ 8 e800000 0001 
DF 8 Writing Rotating Value On Location press *X to abort 
>BKM> 


Scope Loop: Write Then Read — DF 9 Command 


Syntax 


The DF 9 command consecutively writes a specified pattern to the address 
specified and then reads it back. This test can be stopped by typing Ctrl+X. 


DFunit 9 args 
unit — This parameter can be either B (byte), W (word), or L (long). 


args — This parameter consists of a base address base_addr and a hex string 
hex_string 


Example 


Scope Loop writing data to a location, and then reading it back. 
BKM>DF 9 E80000 5555 


DF 9 Writing and reading location press *x to abort 
>BKM> 
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Bus Test: Address — DF A Command 


The DF A command tests the address bus for the purpose of locating system shorts 
on your target board. 


Syntax 
DFunit A start_address 


This command must be executed at the > BKM > prompt. 


unit — This parameter can be either B (byte), W (word), or L (long). Do not leave a 
space between DF and unit. 


Example 


>BKM>d£ a 1000 2000 

Address Bus Test at 00001000 to 00002000. Bus size 16 bits 
TEST PASSED 

>BKM> 


Bus Test: Data — DF D Command 


The DF D command tests the data bus for the purpose of locating system shorts on 
your target board. 


Syntax 
DFunit D address 
This command must be executed at the > BKM > prompt. 


unit — This parameter can be either B (byte), W (word), or L (long). By default, this 
option is set to Word. Do not leave a space between DF and unit. 


address — This is the address of the data bus to test. 


Example 


>BKM>d£ d 100 

Data bus test at 00000100 size 16 bits 
TEST PASSED 

>BKM> 
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3.1.15 Disassemble (Dl) 


This command disassembles the target code beginning at a specified address or 
code symbol. If no address or symbol is given, DI disassembles code starting at the 
program counter. DI disassembles one screen of opcodes (20 lines) as a default, or 
you can include an optional count parameter. Pressing ENTER immediately 
following a DI command disassembles the next count or page of instructions in 
memory. 


Syntax 
DI hex_addr count 


hex_addr — This is an address in target memory at which to begin disassembling. 
hex_addr may also be a previously defined code symbol. The default for hex_addr is 
the program counter. 


count — This is the number of instructions (in hex) that you wish to disassemble. 
The default is one screen, or approximately 20 lines. 


Pressing ENTER immediately following a DI command repeats the command for 
the next count instructions. 


Example 


In this example, eight lines of code located at address 10000 are disassembled. The 
display shows the address, the opcodes, and the disassembled instructions. 
>BKM>di 40400 8 

$00040400 : 0x3D600004 :ppc lis R11, 0x4 

$00040404 : 0x382B2800 :ppc addi R1, R11, 0x2800 

$00040408 : 0x3DA00005 :ppc lis R13, 0x5 

$0004040C : 0x39AD9720 :ppc addi R13, R13, -0x68e0 

$00040410 : 0x3C400005 :ppc lis R2, 0x5 

$00040414 : 0x38429720 :ppc addi R2, R2, -0x68e0 

$00040418 : 0x48000165 :ppc bl 0x4057c 

$0004041C : 0x48000000 :ppc b 0x4041c 

>BKM> 


See also the SI (Single Step) command. 


3.1.16 Disassemble Without Opcode (DIO) 


As with the DI command, this command disassembles the target code beginning 
at a specified address or code symbol. The difference between the DI command 
and the DIO command is that with the DIO command, no opcode row value is 
displayed. If no address or symbol is given, DIO disassembles code starting at the 
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program counter. DIO disassembles one screen (20 lines) as a default, or you can 
include an optional count parameter. Pressing ENTER immediately following a 
DIO command disassembles the next count or page of instructions in memory. 


Syntax 
DIO hex_addr count 


hex_addr — This is an address in target memory at which to begin disassembling. 
hex_addr may also be a previously defined code symbol. The default for hex_addr is 
the program counter. 


count — This is the number of instructions (in hex) to disassemble. The default is 
one screen, or approximately 20 lines. 


Pressing ENTER immediately following a DIO command repeats the command for 
the next count instructions. 


Example 


>BKM>DIO 40400 8 

$00040400 lis R11, 0x4 
$00040404 addi R1, R11, 0x2800 
$00040408 lis R13, 0x5 
$0004040C addi R2, R2, -0x68e0 
$00040410 lis R2, 0x5 
$00040414 addi R2, R2, -0x68e0 
$00040418 bl 0x4057c 

$0004041C b 0x4041c 

>BKM> 


See also the DI (Disassemble) and the SI (Single Step) commands. 


3.1.17 Disassemble with Code Coverage (DIP) 


This command disassembles the target code and shows the corresponding 
profiling data for each instruction. After each instruction, the emulator displays 
the number of samples that were taken in which the program counter (at the time 
of the sample) is equal to the value of the particular disassembled instruction. The 
DIP command disassembles starting at either the program counter, a specified addr, 
or a previously defined code symbol, for count number of instructions. The default 
count is one page of disassembled instructions. 


Also included in the DIP output are symbol boundaries and tabulated profile 
information for each symbol. The sum of the number of hits and percentages on 
the instructions inside each symbol boundary will equal the hits and percentages 
shown for the symbol. The numbers shown are accumulated over total profile 
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time, and not for the last sample period, which can be shown by utilizing the PFA 
graphical display. 


DIP hex_addr count 


hex_addr — address or symbol in target memory to begin disassembling. The 
program counter is the default. 


count — This is the number of instructions (in hex) that you wish to disassemble. 
The default is one screen. 


Pressing ENTER immediately following a DIP command repeats the command for 
the next count instructions. 


NOTE: In order to have meaningful output with the DIP command, first run your 
code under the PFA profiling (see PF RUN command for additional information). 
Then use the DIP command. 


NOTE: If no samples were taken on a particular instruction, no data will be shown 
for the number of hits and percentage of time. 


NOTE: Percentages are calculated to two decimal places, unlike the PFA graphical 
display, where percentages are calculated using integer math. 


Example 


In this example, disassemble code while displaying instruction-level profiling 
data, starting at the address of addone (a previously defined symbol). In addition to 
the number of hits and percentages shown for each instruction, the DIP command 
tallies the total hits for each symbol encountered during the disassembly. 


BKM>dip addone 


addone 1389 
(0.14830 

00008242 link.w aé,#S0 641 (0.068%) 

00008246 move.w $8 (a6) ,dod FL (0.073%) 

0000824A addq.w #$1,d0 107 (0.011%) 

0000824c unlk aé S51 (0.037%) 
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0000824E rts 219 (0.023%) 

main 591014 (63 .279%) 
00008250 link.w a6,#SFFFE 

00008254 lea.1 $84(a5),a2 

00008258 moveq.1 #$11,d1 

0000825A move.1 dl, (a2) 

0000825c bra.w S82EE 

00008260 move.b $c(a5),d1 220 (0.023%) 
00008264 dc.w $49C1 104 (0.011%) 
00008266 cmp.1 (a2) ,d1 Be (0.07%) 
00008268 bge.w $826E 289 (0.030%) 
0000826C Gir. d2 67 (0.07%) 
0000826E clr.w d3 78 (0.083%) 
BKM> 


3.1.18 Display Memory (DM) 


Syntax 


This command returns the contents of the memory location(s) requested. The 
command will display not only the address and the Hex data, but also the ASCII 
representation of that data. In addition, using the syntax indicated below, the DM 
command allows both memory-relative and register-relative addressing. 


DMunit args 


unit — This parameter can be either B (byte), W (word), L (long), or S (string). By 
default, this is set to Word. Do not leave a space between DM and unit. 


args — base_addr number_of_units. Leave a space between base_addr and 
number_of_units. 


base_addr may be a previously defined symbol. 
number_of_units is a hex value. This argument is optional. 


« If unit is set to B (byte), W (word), or L (long), and you do not enter a value 
for number_of_units, then number_of_units defaults to 8. 


« If unit is set to S (string), and you do not enter a value for number_of_units, 
then number_of_units defaults to 90 (5A in hex.) 


« — If unit is set to S (string), and you do enter a value for number_of_units, then 
the number of characters you specify are displayed unless a null character 
(0x00) is encountered first. A null character will always terminate the 
output. 
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Response: addr hex_data ascii_data 


The DM command can also take an indirect address and a register-relative address 
as parameters. The syntax is as follows: 


DMunit (*addr) number_of_units 


DMunit (offset register) number_of_units 


Example 1 


In this example, display 32 (20 Hex) words of memory starting at location 200010: 


>BKM>DM 200010 20 

00200010: FFFF DFFF FFFF FFFF FFFF FFFF FFFF FFFF ..........-e+eee- 
00200020: FFFF FFFE FFFF FFFD FFFF FFFF FFFF FFFF ..........-e+eee- 
00200030: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ..........--2-- 
00200040: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ..........-2--e-- 
>BKM> 


Example 2 


In this example, display five bytes of memory starting at location 300300: 
>BKM>dmb 300300 5 


00300300: FF FF FF FF FF ..... 
>BKM> 


Example 3 


In this example, display 50 bytes of memory at the relative-register address of 1116: 


>BKM>dmb (*1116) 50 


00000100: FD FO BF AC B7 7C FA BF 9A 7C 4E 74 BA EC 3B FF..... | ste [INbe, 227% 
00000110: FC FC FD EF 4F F8 9F F5 FF DC FF FF BA 7C B2 39....0........ ee 
00000120: 7B 70 A7 85 EE FC F7 2F DA FC 67 C6 7D F4 FF FE {p..... Ts en ree 
00000130: E8 7C FE ED 9F F8 3B FE E7 7C F5 BE DF BC 7F 8F .|....;..|...... 
00000140: 87 D8 B2 6F F9 FC B3 FF DB 8C ED BF EF F4 FE 6D ...0........... m 
>BKM> 

Example 4 


In this example, display 10 bytes of memory at the memory-relative address of A2: 


>BKM>dmb (a2) 10 
00001064: 00 08 00 1E 00 00 46 45 42 00 00 00 00 00 00 00 00 ..... BEB seas 
BKM>dr a2 


00001068: 00 00 46 45 42 00 00 00 00 00 00 00 00 00 00 00 O00 ..FEB....... 
BKM> 
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3.1.19 Display Memory Double (DMD) 


The DMD command is only for relevant architectures. This command obtains data 
via full 64-bit read operations. 


Syntax 
DMD args 
args — base_addr number_of_units; a previously defined symbol may be used for 
base_addr. 
Response: addr hex_data ascti_data 
The DMD command can also take an indirect address and a register-relative 
address as parameters. The syntax is as follows: 
DMD (“addr) number_of_units 
DMD [offset] (register) number_of_units 

Example 1 
In this example, display memory starting at location 200010: 
>BKM>dmd 200010 20 
00200010: FFFFDFFFFFFFFFFF FFFFFFFFFFFFFFFF = ..........--.005 
00200020: FFFFFFFEFFFFFFFD FFFFFFFFFFFFFFFF = ..........-- 000s 
00200030: FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFF = ..........-.-005 
00200040: FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFF 9 ..eeee eee eee eee 
00200050: FFFFFFFFFFFFFFFF FDFFFFFDFFFFFFBF wwe e eee eee ee eee 
00200060: FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFF = ...........-.005 
00200070: FFFFFFFFFFFFFFFF FFFFFFFFFFFFFF7F 99 ..eeeeeeeeeeeeee 
00200080: FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFE 9 ...eeeee eee ee eee 
00200090: FFFFFFFFFFFFFFF7 FFFFFFFFFFFFFFFF 9 v.eeee eee eee eee 
002000A0: FFFFFFFFFFFFFFFF F7FFFFFFFFFFFFFD = ...eee eee eee eee 
002000B0: FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFF 9 ...eeee eee ee eee 
002000CO: FFFFFFFFDFFFFFFF FFFFFFFFFFFFFFFF 9 ..eeeeee eee ee eee 
002000D0: FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFF 9 ..eeeeee eee eee 
002000E0: FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFF = ...........--005 
002000F0: FFFFFFFBFFFFFFFF FFFFFFFFFFFFFFFF = ...........--005 
00200100: FFFFFFFFFFFFFFFF FFFFFFFFFFFFFFFF = ...........--005 
>BKM> 

Example 2 


In this example, display memory at the relative-register address of 1116: 


>BKM>dmd (*1116) 100 

00000000: 9421FFE090610008 9041000000000000 whee P Aes ARs sre as 
00000010: 0000000000000000 O000000000000000 ~~ ....... eee eee eee, 
00000020: 0000000000000000 O000000000000000 ~~... . ee ee ee eee. 
00000030: 0000000000000000 O0D0000000000000 ~~... eee ee eee. 


36 


3 Low-Level Commands 
3.1 Low-Level Commands 


3.1.20 Display Registers (DR) 


The DR command displays the contents of a particular register or registers. To 

display all registers, enter DR ALL. If no arguments are specified, then the general 
purpose registers for most processor families will be displayed/returned. The 

active stack is flagged with an asterisk *. 


Syntax 


DR options 


options can be either reg_name, the name of the register you wish to display the 
value for, or group_name, the name of the register group whose registers you want 
to display. If you do not specify an option then all of the registers are displayed. 
You can specify more than one register at a time, leaving a space between each 
reg_name or group_name. 


Response: option = value 


Example 1 


Displaying all registers with the DR ALL command would take up too much space 
here. In this example, the DR command is used to display all general purpose 


registers. 
>BKM>dr 
ROO = Q0O0E17F2C ROL = QOEFFF30 R02 = QOEO7FFO R03 = 00000001 
ROA = 00000000 R05 = OOEFFF38 R06 = 00000001 R07 = OOEFFF3C 
ROS = 000D1788 R09 = 00000008 R10 = 00000000 R11 = 00000000 
R12 = 00000000 R13 = 00E22C00 R14 = 00E2847C R15 = 00000000 
R16 = 00000000 R17 = 00E294F8 R18 = E396FFBE R19 = ADAEF77B 
R20 = 762EFEDD R21 = F813F3A2 R22 = F3E71E7F R23 = A836CDEE 
R24 = 7B7F9EFE R25 = 593A65BF R26 = 2513F4FB R27 = E2FB608F 
R28 = EC6DCFDF R29 = A9F275EB R30 = 00E23144 R31 = 00E24310 
CR = 20000000 MSR = 00009042 LR = 00E19870 SRRO = 00E1986C 
SRR1 = 00009002 SPRGO = 00000000 SPRG1 = 00000000 SPRG2 = 00000000 
SPRG3 = 00000000 XER = 00000300 CTR = 00000000 PC = 00E198BC 
>BKM> 

Example 2 


In this example, set values in some registers. Then display these registers in a 
different order: 


>BKM>SR ROO 1000000 RO3 120000 RO8 1234 R16 55 

>BKM>DR RO8 R16 ROO RO3 

RO8 = 00001234 R16 = 00000055 ROO = 01000000 RO3 = 00120000 
>BKM> 


See also the SR (Set Register) command. 
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3.1.21 Display Trace Non-Real-Time (DT) 


The DT command is used to display both real-time and non-real-time trace. The 
options for the DT command are different for the real-time modes. 


The non-real-time trace buffer only has valid history if tracing was previously 
enabled, either directly with the Trace Enable command or indirectly by setting a 
data breakpoint, for example. The trace buffer contains PC-only history 
information. 


Syntax 
DT arg] arg2 num 
arg1 — This can be specified as either B (backwards), or F (forwards). By default 
this option is set to B. 
arg2 — This option is set to F - full trace with data movements. 
num — This is the number of locations to be displayed. By default, this is 20 lines 
of information. 

Example 


In this example, the non-real-time trace display of three instructions that were 
executed are shown: 


BKM>DTB 3 

ab ee 00ea6070 2080 move.b di, (a0) 
18. 00ea6074 1O0BCOOAA move.1 #SAA, (a0) 
17. 00ea6076 2210 move.1 (a0) ,dl 
BKM> 


See also the CF (Configure) and the TE (Trace Enable) commands. 


3.1.22 Display License Key String (ESTKEY) 


Syntax 


The ESTKEY command displays the actual encrypted license key string for your 
emulator. 


ESTKEY 


Example 


>BKM>estkey 
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AC1WXYJNB140G7C6GFD3H28DBK909VUODBO (*) Main Key 
>BKM> 


3.1.23 Display License Key Support Information (ESTKEY DISPLAY) 


The ESTKEY DISPLAY command returns the current Wind River license support 
information. 
Syntax 


ESTKEY DISPLAY 


Example 


Below is an example of this command executed on a Wind River ICE SX unit. 
>BKM>estkey display 
Key In Use: Main Key 
FLEXLM licensing: Enabled 
Serial Number: W0000000 


Group Id: 0 
>BKM> 


3.1.24 Fast Step (FS) 


The Fast Step command allows you to step continuously through a specified code 
range. To use this command, first make sure that your PC is within the code range 
that you specify for fast stepping. If you do not specify a code range to Fast Step 
through, the FS command reverts to a simple single step, stepping one instruction 
at the current program counter. 

Syntax 


FS start_address end_address 


In this case, start_address and end_address specify the address range for the 
debugger to continue stepping until the program counter is outside the range. 


Both start_address and end_address are optional parameters. 


If neither parameter is specified, the FS command reverts to a simple single step, 
stepping one instruction at the current program counter. 


If only one parameter is given with the FS command, for example: 


FS end_address 
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...then the start_address is taken as the current program counter. In this case, FS 
steps until it is outside of the range of the current program counter, and the 
end_address is given. 


Examples 


In the following examples, memory is at 5000 and the current program counter is 
at 5000. 


BKM>FS 

@5004 

BKM>FS 500E 
@5010 

BKM>FS 500E 5010 
@5004 

BKM> 


3.1.25 Fast Step Next (FSN) 


Syntax 


The Fast Step Next command is similar to a Fast Step in that it lets you step 
continuously through a specified code range. The difference between them is that 
instead of stepping into each line of code, FSN steps over each line. To use this 
command, first make sure that your PC is within the code range that you specify 
for fast stepping. If you do not specify a code range to Fast Step through, the FSN 
command reverts to a simple step over command, stepping over one instruction at 
the current program counter. 


FSN start_address end_address 


In this case, start_address and end_address specify the address range for the 
debugger to continue stepping until the program counter is outside of the range. 


Both start_address and end_address are optional parameters. 


If neither parameter is specified, the FSN command reverts to a step over, stepping 
one instruction at the current program counter. 


If only one parameter is given with the FSN command, for example: 
FS end_address 


then the start_address is taken as the current program counter. In this case, FSN 
steps until it is outside of the range of the current program counter, and the 
end_address is given. 
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Example 


>BKM>fsn 
@00040d88 


>BKM>fsn 40d84 40e7c 
>RUN> 3 


@000406c8 
>BKM> 


See the FS command for more information. 


3.1.26 Start Code Execution (GO) 


The GO command deactivates debug mode and begins executing user code on the 
target. Code execution continues until either a breakpoint occurs, the system is 
reset, a double bus fault occurs, or you stop the target by typing Ctrl+C or Ctrl+X. 
If breakpoints are enabled, a BKMD instruction is inserted into the target code at 
each breakpoint address (TRAP instructions are used in simulation). This allows 
real-time execution of target code and still allows for breakpoints to be set. 


If the location where execution begins contains a breakpoint, then that breakpoint 
is temporarily disabled until the program is stepped off of the breakpoint. If an 
assertion has been set then, the GO command enables the trace buffer and checks 
for break conditions after each instruction is executed. After the GO command is 
issued, the emulator displays the >RUN> prompt, indicating that the target is 
running in real-time. 


Syntax 


Go flag addr 


flag — This parameter can be set to either T (Trace Enabled), or D (Trace Disabled. 
By default, this is set to no change. 


The flag argument is a way to combine the Trace Enable or Trace Disable 
commands with the GO command. This is optional, and if it is not specified, then 
there is no change to the trace conditions previously set. The tracing mode will 
remain in effect until it is specifically changed by another GO command or by the 
Trace Enable or Trace Disable commands. 


addr — This parameter is the hex address where execution mode will resume. 


Example 1 


In this example, examine the instructions located at address 10000. Set a breakpoint 
and verify that it is the only condition set up. Disable tracing. Finally, issue the GO 
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command, allowing Execution Mode to operate in Real-Time. Notice the prompts 
that are displayed: 


BKM>DI 10000 8 
00100000 2200 move.1 DO, D1 


00100002 4282 elr.1 D2 
00100004 D401 add.b 1,D2 
00100006 E289 lsr.1 1,D1 
00100008 66FA bne.b $10004 
0010000A E20A lsr.b #1,D2 


0010000C 55C2 scs D2 
0010000E 60FE bra. $1000E 


o 


BKM>SB 1000E 


BKM>DB 


Code Break-Points 


1. O1O000E count = 0001 actual = 0000 enabled 


BKM>GO 10000 


. RUN> 


!BREAK! - Breakpoint at 001000 


ie 


BKM> 


Example 2 


In this example, assume only one address breakpoint is set at location 1000E. First, 
issue a GO command with trace enabled. Once the breakpoint is taken, issue 
another GO command from the same place. Finally, explicitly disable tracing and 
issue the GO command again. Notice that tracing is still enabled for the second GO 
command: 


BKM>GOT 10000 
TRC> 


!BREAK! - Code Breakpoint at 001000E 


BKM>GO 10000 

TRC> 

!BREAK! - Code Breakpoint at 001000E 
BKM>GOD 10000 


RUN> 


BREAK! - Breakpoint at 001000E 
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BKM> 


See also DI (Disassemble) command, SB (Set Breakpoint) command, DB (Disable 
Breakpoints) command, TE (Trace Enable) command, and TD (Trace Disable) 
command. 


3.1.27 Start Performance Analysis (GOP) 


Syntax 


This command starts execution of the target system with Performance Profiling 
activated. You can only issue a GOP command while the target is in Background 
Mode. The GOP command begins the sampling process from the specified address 
or code symbol. Issuing a GOP command automatically opens the PFA graphic 
display (histogram) if the graphics switch is turned on in the PF command. If the 
graphics switch is turned off, the GOP command issues the >PFA> prompt. At this 
prompt, issue a DIP (Disassemble with Code Coverage) command to view the code 
profiling information by disassemble instruction or by symbol, respectively. 


GOP addr 


By default, addr is a program counter. A previously defined symbol may be 
substituted for addr. 


Examples 
Table 3-1 GOP Examples 
BKM>GOP Starts profiling at the current program counter and opens the PFA 


histogram and chart display. 


BKM>GOP 1000 Starts profiling at 1000 and opens the PFA display if the graphics are 
on in the PF command. 


BKM>GOP main Starts execution and profiling at main and issues the >PFA> prompt 
if graphics are turned off. 


NOTE: The GOP command only operates from a stopped system (>BKM> prompt). 


To start performance analysis from a running system (>RUN> prompt), use the 
PF RUN command. 
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NOTE: You must disable any active breakpoints before executing the GOP 
command. Use the DB (Disable Breakpoints) command or RB (Remove 
Breakpoints) command. 


NOTE: Performance Analysis does not operate in Trace mode. You must explicitly 
disable tracing (using the TD command). 


NOTE: The GOP command either directly opens the PFA graphic display or issues 
the >PFA> prompt, depending on whether or not the graphics switch is turned on 
or off in the PF command (option 5). If graphics are turned on, the GOP command 
opens the display with parameters (PFA range, graph type, sampling period) that 
are currently set in non-volatile memory. To change these parameters, use the PF 
command, or change them from within the graphic display. 


NOTE: From the >PFA> prompt, use the DIP command to disassemble code with 
profiling data. Additionally, issue a DM, SM, DR, SR, or DI command in the form 
of a special target snapshot from the >PFA> prompt. You cannot issue a trace, 
breakpoint, or configuration command. 


NOTE: Enter Ctrl+C from the >PFA> prompt to discontinue profiling, stop the 
target, and return to a >BKM> prompt. Exiting the graphic display with the F9 key 
returns you to the >PFA> prompt, so you must use Ctrl+C to stop the code 
profiling. 


3.1.28 Synchronized Start Code Execution (GOS) 


Syntax 


Gos 


Resume code execution for the group of cores defined by the SCTRL command. 
The resume operation is synchronized on the same edge of the JTAG clock signal. 


This command also activates hardware polling and the low latency breakpoint 
cross-triggering as configured by the SCTRL command. 


This is a multi-core command and is only supported for the Wind River ICE SX. 
See also the HALTS and SCTRL commands. 
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3.1.29 Halt (HA) 


Syntax 


HA, HALT, or Ctrl+C 


When entering background mode fails due to a register value set incorrectly by a 
software application, the emulator will wait for the amount of time set in the 

CF TOUT option before issuing a non-maskable break to the target. If this occurs, 
the following message is displayed: 

>RUN> 

!BREAK! - [msg12007] User forced halt; PC = 0x000142F0 

>BKM> 

You can stop the target running by typing HA or HALT at the >RUN> or >TRC> 
prompt. You can also stop the target or a command that is currently executing by 
typing Ctrl+C or Ctrl+X. 


3.1.30 Synchronized Halt (HALTS) 


Syntax 


HALTS 


Halt code execution for the group of cores defined by the SCTRL command. The 
halt operation is synchronized on the same edge of the JTAG clock signal. 


This is a multi-core command and is only supported for the Wind River ICE SX. 
See also the GOS and SCTRL commands. 


3.1.31 Help Command (HE) 


Syntax 


The HEcommand displays the emulator’s help menu. The menu shows the syntax 
of the command set. You can see additional help for each command by typing the 
command name as an argument. 


HE command 


command is the command for which help will be displayed. 


Entering HE with no arguments displays all available help. 
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Display all commands: 


>BKM>he 

==== MISCELLANEOUS === 
SH: Show History 

CF: Configure 

CS: Chip Selects 

TF: Target Flash 

IN: Initialize 

sc: System Configuration 
===== EXECUTION ======= 
GO : Start Execution 
“C/*X: Stop Execution 
HALT : Stop Execution 

DF Run Diagnostics 

= HARDWARE BREAKPOINTS = 
HBC :Set HB on Code 

HBD :Set HB on Data 
HBTC:Set HB on N Cycle 


For Help on a specific command, 


>BKM 


Example 2 


> 


SOFTWARE BREAKPOINTS = 


DB: Display Breakpoints 

BD: Disable Breakpoints 

BE: Enable Breakpoints 

RB: Remove Breakpoints 

SB: Set Code Breakpoint 
STEPPING & DISASSEMBLY = 
SI : Step Instructions 

FSN: Step Over 

DI Disassemble Code 

FS Fast Step In 

ST Stack Trace 

STO: Step Out 

ASM: Inline Assembler 
== PERFORMANCE ANALYSIS== 
PF Perforemance Analysis 
DIP: Dis. with Perf. Anal. 


type: 


In this example, display help for the ASM command: 


>BKM>he asm 

Command Description 
ASM Inline Assembler 
>BKM> 
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REGISTERS & MEMORY 
Display Registers 
Set Registers 
Display Memory 
Memory Modify 
Set Memory 
Block Memory Fill 
Block Memory Move 
Search for String 


=== TRACING 
Trace Disable 
Trace Enable 
Display Trace 
Set a Trace Point 


HE {command} {parm1} {cr} 


Syntax 
Form 1 ASM <start_addr> <instruction> 
Form 2 ASM <start_addr> 
then <instruction>. 
or <enter>....... Skip this addr 
OL) SS cues enstentee Stop 
Form 3 ASM <no addr> 


takes the PC as the starting addr. 


3 Low-Level Commands 
3.1 Low-Level Commands 


3.1.32 Hardware Interface Configuration (HIC) 


Syntax 


(Wind River Probe only) 


Use the HIC command to change the properties of the Wind River Probe electrical 
interface. 


HIC 


Entering HIC with no arguments returns a list of all user-changeable electrical 
properties: 


>BKM>hic 
Clock Frequency in KHz CLKK[25...100000] = 16000 
Clock Phase CLKPHASE[-180..+900] = 0 
Clock External synchronization RTCK[ENABLE, DISABLE] = DISABLE 
CLK Drive Strength CLKSTRENGTH[1..4] = 2 
TMS Drive Strength TMSSTRENGTH[1..2] = 1 
TDI Drive Strength TDISTRENGTH[1..2] = 1 
Target Interface voltage Override VOLTAGE [3.3V,2.5V,1.8V,VIO] = VIO 
Target Interface termination voltage TERMVOLTAGE [2.5V-3.3V,1.8V-2.5V] = 
2.5V-3.3V 
CLK Termination CLKTERM [ACTIVE_HI, ACTIVE_LO, PASSIVE] = ACTIVE_HI 
TS Termination TMSTERM [ACTIVE_HI, ACTIVE_LO, PASSIVE] = ACTIVE_HI 
TDI Termination TDITERM[ACTIVE_HI, ACTIVE_LO, PASSIVE] = ACTIVE_HI 
TDO Termination TDOTERM [ACTIVE_HI, ACTIVE_LO, PASSIVE] = ACTIVE_HI 
GPIOO Termination GPIOOTE [ACTIVE_HI, ACTIVI ] = ACTIVE_HI 
GPIO1 Termination GPIO1LTERM [ACTIVE_HI,ACTI ] = ACTIVE_HI 
GPIO2 Termination GPIO2TERM [ACTIVE_HI,ACTI ] = PASSIVE 
GPIO3 Termination GPIO3TERM [ACTIVE_HI, ACTIVI ] = PASSIVE 
GPIO4 Termination GPIO4TERM [ACTIVE_HI, ACTIVI ] = PASSIVE 
GPIO5 Termination GPIO5TERM [ACTIVE_HI, ACTIVI ] = PASSIVE 
GPIO6 Termination GPIO6TERM [ACTIVE_HI,ACTI ] = PASSIVE 
GPIO7 Termination GPIO7TERM[ACTIVE_HI,ACTIVE_LO, PASSIVE] = PASSIVE 
GPIO Output Enable Value (GPIO7..GPIO0O) GPIOXOE[VALUE] = 0x01 
GPIO Output Value (GPIO7..GPIO0) GPIOXOV[VALUE] = 0x03 
GPIO Intput Value (GPIO7..GPIOO) = 0x27 
>BKM> 

Example 


In this example, set the strength of the TCK signal to 4. 
>BKM> HIC TCKSTRENGTH 4 


When all parameters are configured, you can save the configuration in XML 
format using the command HIC BRDDUMP: 


>BKM>hic brddump 

<‘  CLKK>16000</CLKK> 
<CLKPHASE>0</CLKPHASE> 
<RTCK>DISABLE</RTCK> 
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<CLKSTRENGTH>2< /CLKSTRENGTH> 
<TMSSTRENGTH>1</TMSSTRENGTH> 
<TDISTRENGTH>1</TDISTRENGTH> 
<VOLTAGE>VIO</VOLTAGE> 
<TERMVOLTAGE>2 . 5V-3 . 3V</TERMVOLTAGE> 
<CLKTERM>ACTIVE_HI</CLKTERM> 
<TMSTERM>ACTIVE_HI</TMSTERM> 
<TDITERM>ACTIVE_HI</TDITERM> 
<TDOTERM>ACTIVE_HI</TDOTERM> 
<GPIOOTERM>ACTIVE_HI</GPIOOTERM> 
<GPIO1LTERM>ACTIVE_HI</GPIO1TERM> 
<GP1IO2TERM>PASSIVE</GPIO2TERM> 
<GP1I03TERM>PASSIVE</GPIO3TERM> 
<GPIO4TERM>PASSIVE</GPIO4TERM> 
<GPIO5TERM>PASSIVE</GPIOS5TERM> 
<GPIO6TERM>PASSIVE</GPIO6TERM> 
<GP1O7TERM>PASSIVE</GPIO7TERM> 
<GPIOXOE>0x01</GPIOXOE> 
<GPIOXOV>0x03</GPIOXOV> 
<GPIOXIV>0x27</GPIOXIV> 


162 ee a 9 | 


GI 


>BKM> 


Copy this output to a board file that you can use for every connection. 


3.1.33 Internal Code Breakpoint (IHBC) 


Syntax 


The IHBC command is used to set an internal hardware breakpoint on code 
execution. This command initializes a program counter comparator with the 
address of the breakpoint. The processor breaks prior to executing the instruction 
at the breakpoint address. 


Unlike software breakpoints (which require the emulator to overwrite the 
breakpoint instruction with a HALT or Software Emulation Exception Instruction 
and can only be set in read/write memory), internal hardware breakpoints can be 
used to set breakpoints in read only memory (Flash or ROM). 


This command is only supported with microprocessors that have program counter 
comparators. 


IHCB addr 


addr — This is the address of the instruction. 
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Example 


Set an internal code breakpoint at address 0x1000. 


>BKM>ihbc 1000 
>BKM> 


3.1.34 Internal Data Breakpoint (IHBD) 


Syntax 


The IHBD command is used to set an internal hardware breakpoint on data 
accesses. The command initializes an address comparator with the address of the 
breakpoint. This command may have a data argument, and can be further 
qualified when the operand access is a read or write. 


The IHBD command is only supported with microprocessors that have address 
and data comparators. 


IHBD optional_qualifier addr optional_data 


optional_qualifier — This parameter is either R (read), W (write), or it can be left 
without any qualifier, which permits any access. 


addr — This parameter is the address of the operand. 


optional_data — This parameter is optional, and you can use it to specify a condition 
that you want met before a break occurs. Using this option you can cause the target 
to break only when a specified value is read or written at the address specified in 
addr. 


Examples 


Set an internal breakpoint at address 0x1000 and break on any access (read or 
write) to this address. 


BKM>ihbd 1000 

Set an internal data breakpoint on any read to address 0x1000. 

BKM>ihbdr 1000 

Set an internal data breakpoint on any write to address 0x1000. 

BKM>ihbdw 1000 

Set an internal data breakpoint on a read of value of 0x00000003 at address 0x1000. 


BKM>ihbdr 1000 00000003 
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3.1.35 Initialize System (IN) 


Syntax 


The IN command attempts to initialize Background Mode communications. Once 
proper communications are established, the emulator transfers the chip-select 
table (modifiable with the CS command) and the stored register settings (which 
can be modified with the SC command) to the target system using the emulator. 
The IN command is automatically sent after every emulator power-up or reset. To 
initialize Background Mode communications without writing the chip-select table 
and register settings to the target, use the INN command. 


IN 


This command initializes and downloads the chip-select and register settings, and 
initializes communications with your target. 


Initialization Messages 


The emulator goes through the following sequence after the IN command is issued, 
assuming that it is able to properly establish background mode communications 
with the target: 

>BKM>in 
KEKKKKKKKKKKKKKKKKKEK KKK KKK KK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKKKKKKKKKKKKKKKKEKK 


Wind River ICE Initialization Sequence. 
Copyright (c) Wind River Systems, Inc., 1999-2004. All rights reserved. 


KR KKK KKK KKK KK KKK KKK KKK KKK KK KKK KKK KK KK KKK KK KK KKK KKK KK KKK KKK KKK KKK KKK KKK KKK KKK 


Support Expires....... 5/17/07 

Target Processor...... MPC8260 

Wind River ICE Group ID#= 0 

Wind River ICE Serial#= w0000000 Firmware= vn2.3a 
Type CF For a Menu of Configuration Options 

Initializing Background Debug Mode.............. Successful 

>BKM> 


NOTE: The information displayed at an INcommand varies slightly depending on 
the type of system you are using. For example, the support expiry date and the 
target processor may be different than what is displayed here. 


3.1.36 Initialize Communications Only (INN) 


The INN command is similar to the IN command in that it places a target in 
background mode. The difference is that the INN command does not download 
any of the register settings or the chip-select settings that are stored in the emulator. 
The INN command only places the target in background mode. If you use this 
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command, your target settings and the settings stored in the emulator may not be 
the same. The next time you power on your emulator, an IN command is 
automatically performed and so your target settings are overwritten by the 
emulator settings. Make sure that you are aware of this issue and try to keep your 
target settings and the emulator settings in sync at all times. 


INN 


Initialization Messages 


The emulator goes through the same sequence as the IN command when the INN 
command is issued, assuming that it is able to properly establish communications 
with your target: 

>BKM>inn 

KREKKKKKKEKK KKK KKK KKK KKK KKK KKK KK KKK KKK KKK KKK KKK KEK KKK KK KKK KKK KKKKEKKEKKKKKKKKKEKEK 


Wind River ICE Initialization Sequence. 
Copyright (c) Wind River Systems, Inc., 1999-2004. All rights reserved. 


KR KKK KKK KKK KK KKK KKK KKK KKK KK KKK KKK KR KKK KKK KKK KK KKK KKK KKK KKK KKK KKK KKK KKK KKK KKK KEK 


Support Expires....... 5/17/07 

Target Processor...... MPC8260 

Wind River ICE Group ID#= 0 

Wind River ICE Serial#= w0000000 Firmware= vn2.3a 
Type CF For a Menu of Configuration Options 

Initializing Background Debug Mode.............. Successful 

>BKM> 


See the IN command for more information about initializing your system. 


3.1.37 Initialize and Trap Exceptions (INE) 


The INE command is a special initialization command which allows the emulator 
to trap and decode exceptions that are not properly handled by the application 
code. You may only use this command from a > BKM > prompt or >ERR> prompt. 
The INE command cannot be used as a target snapshot. 


The INE command performs the standard initialization sequence (refer to the IN 
command for more information), including chip-select and register download. If 
valid communications are established with the target, the INE command also 
initializes all exception vectors, not including the restart vector at the first eight 
longs, by writing a general exception address in each location in the exception 
vector table. 


After initializing with the INE command and issuing a GO command, if you hit a 
breakpoint, the emulator determines if the breakpoint was at the location pointed 
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to by the general exception. This is the address at the end of the event to which all 
uninitialized vectors point. If the target breaks at this location, the emulator 
uploads the exception stack frame from the target and decodes it for you. 


If you take the general exception and stopped at a breakpoint at the end of the 
event, the emulator displays: 


«» A!BREAK! - Exception Trap Handler message 

« The location in memory of the exception stack frame 

« The program counter where the exception took place and/or the faulted 
address, if they are not the same 

« The exception type and vector offset 

« The target registers at the time of the exception 


The INE command assumes that the vector table is located at 0, unless you include 
a non-zero VBR as an optional parameter. If your vector table is in ROM, you can 
use the INE command by giving it an arbitrary RAM-based VBR, and then 
manually changing the VBR using the Set Register command (SR VBR 
RAM_Address). 


You only need to use the INE command once after system power-up because the 
installed vectors remain loaded. 


Syntax 
INE VBR _ addr 
VBR_addr — this is an optional parameter that specifies a non-zero VBR. 
Examples 
Table 3-2. INE Examples 
BKM>INE Initializes Background Mode communications (displays the emulator 
banner), downloads the chip-select table and registers, sets all exception 
vectors (except the restart vector) to an address just after the EVT, and 
sets a breakpoint at that address. The VBR is assumed to be zero. 
BKM>GO If a bus error occurs after code starts executing (GO), the emulator traps 
the error and decodes the exception stack frame. 
RUN> 
!BREAK! - Exception trap handler 


Exception Stack Frame Starts at SOO00F4E8 
Faulted Address = $0000FB90 
Current Instruction Program Counter = $000500E 
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Syntax 
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Special Status Word = 0225 
Bus Error - Exception vector offset = 0008 
(Displays Registers at the time of the Bus Error) 


Use the MM command to modify memory without a read verify. 


Using the syntax described below, the MM command allows both memory-relative 
and register-relative addressing. 


The MM command differs from the SM command in that the MM command only 
modifies the memory at a specified address; it does not read back the value to 
verify that it wrote correctly. 


MMunit base_addr data 


unit — This can be either B (byte), W (word), or L (long). By default, the option is 
set to word. Do not leave a space between MM and unit. 


base_addr — This is the beginning address of the memory that you want to modify. 
data — This is the data to be written to the address specified by base_addr. 


The Memory Modify command can also take an indirect address and a 
register-relative address as parameters. The syntax is as follows: 


MM(*addr) data 


Example 1 


In this example, set a word at 1000 to OC, set a long at OFFE to 100, and set a byte 
at FBO to OA: 


BKM>MM 1000 0C 
BKM>DM 1000 

00001000: O000C 4E00 4645 4200 4D41 5200 4150 5200 ..N.FEB.MAR.APR. 
BKM>MML OFFE 100 
BKM>DM OFFE 

OOOOOFFE: 0000 0100 4E00 4645 4200 4D41 5200 4150 ..N.FEB.MAR.APR 
BKM>MMB FBO 0A 
BKM>DM FBO 

OOO000FBO: OA0O 0000 0000 0000 0000 0000 0000 0000 .......2.. 


Example 2 


In this example, modify the memory at the relative-register address of 1116: 
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>BKM>mm (*1116) 1234 

>BKM>dm (*1116) 

00000000: 1234 FFEO 9061 0008 9041 000C 7C7A 02A6 Ae ve Aa. Bd, || Ziace 
>BKM> 


3.1.39 Memory Modify — Double (MMD) 


Syntax 


The MMD command is for specific architectures. This command modifies memory 
via full 64-bit read operations. 


MMD args 
args — base_addr data; a previously defined symbol may be used for base_addr. 
Response: addr hex_data ascti_data 


The Memory Modify Double command can also take an indirect address and a 
register-relative address as parameters. The syntax is as follows: 


MMD (“addr) number_of_units 


Example 1 


In this example, modify the memory starting at location 200010, and then display 
it using the DMD command: 


>BKM>mmd 100020 1234 

>BKM>dmd 100020 

00100020: 0000000000001234 7C6802A690610018  ....... 4|h...a..| 
00100030: 4800001D00EO7FFO O0E22C0000E2852C Tica cartier scons pee a Ee 
00100040: OO0E02B1800000000 OOEO2A9C7C4802A6 OR a ee [HL 
00100050: 80620008BC830010 9003000080810000 gD wi denchane ie: axe Pegtearie, oc 
>BKM> 


Example 2 


In this example, modify memory at the relative-register address of 1116 and 
display it using the DMD command: 


>BKM>mmd (*1116) 1234 
>BKM>dmd (*1116) 


00000000: 0000000000001234 9041000C7C7A02A6 3... ..... . ASB | Zee 
00000010: 7C5B02A690610010 904100147C6000A6 | Leevae. Ae! | ec 
00000020: 0000000000001234 7C6802A690610018 ....... 4|h...a.. 
00000030: 4800001D00EO7FFO O0E22C0000E2852C Hisneratgietece sea er eaey 
>BKM> 


See also the DMD command. 
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3.1.40 Memory Management Unit (MMU) 


NOTE: Use of this command requires an MMU-enabled license. EE 
3 


The Memory Management Unit commands allow you to add and manipulate data 
included in the MMU table. MMU commands are not available for all processors. If 
your processor does support MMU commands, you need to enable the MMU 
configuration option. See the CF command for more information on enabling the 
MMU commands. 


NOTE: These MMU commands only set up the Memory Management table on the 
emulator unit. They do not set up this information on the target. Any information 
programmed into the Memory Management table should correspond to the 
information that your code is setting up on the target. 


MMU Commands 


Table 3-3 


MMU Commands 


MMUA Add an entry to the MMU table. 
MMUL Displays the MMU table. 
MMUD Deletes entries from the table, either one at a time or all at once. 


Each of the commands is described in the sections that follow. 


Memory Management Unit — Add (MMUA) 


Syntax 


This command lets you add an entry to the table in your Wind River emulator. 


There are two ways that you can add an entry to your table. The first way is to enter 
all of the data on the same line, as shown. 


MMUA logical_address physical_address mask 


logical_address — This is the virtual address that the applications use to locate a 
device on your target. 


physical_address — This is the physical location of the device on your target. 
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The second method is to type MMUA and press ENTER. 

MMUA 

This method prompts you for each of the required parameters (/ogical_address, 
physical_address, and mask). 


Examples 


The first example illustrates adding an entry to the MMU table in the emulator 
using the MMUA logical_address physical_address mask syntax. The table is then 
displayed using the MMUL command. 


>BKM>mmua c000000 0 ££000000 


>BKM>mmul 

Index | Logical | Physical | Mask 
a |--n-nnnaannnnnn | onan nnn nnnnn | acne ennnnn 
01 | 0x0co000000 | 0x00000000 | Oxf£000000 
>BKM> 


The second example illustrates adding an entry to the MMU table in the emulator 
using the MMU ENTER syntax. 


>BKM>mmua 

Logical Address :d0000000 

Physical Address :100 

Mask :££000000 

>BKM>mmul 

Index | Logical | Physical | Mask 
~=--- | --------~--- | --=----------=| --=---------- 
01 | 0x0c000000| 0x00000000 | Oxf£000000 
02 | 0x0d000000| 0x00000100 | Oxf£000000 
>BKM> 


NOTE: The entry labelled 01 in the table is only included if you added the line to 
the table using the syntax in the first example. If you only worked through the 
second example, the line labelled 02 will be labelled 01, and will be the only entry 
in the table. 


See also the MMUL command. 


Memory Management Unit — List (MMUL) 
This command displays the MMU table, showing any entries that are included in it. 


Syntax 


MMUL 
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No parameters are required for this command. 


Example 


This example displays the MMU table: 


>BKM>mmul 

Index | Logical | Physical | Mask 

eee de ese eS | Setoeet sooo ee | ecerteta Beste 5 
01 0x0c000000 | oOx00000000 | Oxf£000000 
02 | 0x0d000000 | 0x00000100 | O0xf£000000 
>BKM> 


See also the MMUA command. 


Memory Management Unit — Delete (MMUD) 
This command deletes an entry in the MMU table. 


Syntax 
MMUD IndexNumber 


IndexNumber — This is the index number of the line that you want to delete from 


your MMU table. The index number is visible in the first column of the MMU table. 


Entering MMUD without specifying an index number will delete the entire table. 


Example 


The following example displays the MMU table with two entries in it, deletes the 
second entry, and displays the MMU table again, this time with only one entry. 


>BKM>mmul 

Index Logical Physical Mask 

01 0x0c000000 0x00000000 Ox££000000 
02 0x0d000000 0x00000100 Oxf£000000 
>BKM>mmud 2 

>BKM>mmul 

Index Logical Physical Mask 

01 0x0c000000 0x00000000 Oxf£000000 


See also the MMUL command and the MMUA command. 
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3.1.41 Linux Virtual Memory Management (MMUOS) 


MMUOS ADD 


Syntax: 


The MMUOS commands allow the user to define and manage a set of 

addresses / offsets (symbols) to the Linux Page Directories, which the MMU engine 
of the emulator firmware (and associated plugin) uses to acquire the necessary 
information for Linux Virtual Memory Management emulation. 


There are several MMUOS commands with various functions, as described below. 


NOTE: To use the MMUOS commands, you must have the CF MMU option set to 
ENABLE. 


This command adds an MMUOS entry to the list. 
Currently used TYPE defines are: 
String: define the MMUOS entry as a string. 


Constant: define the MMUOS entry as a constant hexadecimal based value. 


MMUOS ADD 


MMUOS DELETE 


Syntax: 


This command deletes an entry from the MMUOS list. 


MMUOS DELETE Name 


Name is the entry you want to delete. If you do not specify an entry, this command 
will delete the entire MMUOS list. 


MMUOS DISPLAY 


This command displays the MMUOS list. 
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MMUOS DISPLAY 


Example: 


MMUOS SET 


Syntax: 


NAME | TYPE | VALUE 


pidhash | Constant | 0xc01lab094 
swapper_pg_dir | Constant | 0xc0lab094 
kernelsp | Constant | 0x00000000 
TASK_PId_Offset | Constant | 0x00000080 
TASK_THREAD Offset | Constant | 0x00000270 
TASK_HNEXT_Offset | Constant | 0x000000b4 
THREAD_PGDIR_Offset | Constant | 0x0000000c 
HOOK_PageAlloc | Constant | Oxffffffff 


This command sets the value of an entry on the MMUOS list. 


mMuOoS SET Entry Value 
Entry is the entry you want to change. 


Value is the value you want to change the entry to. 


3.1.42 Performance Analysis (PF) 


Syntax 


The PF command lets you specify performance analysis parameters (code profiling 
start and end range, graph type, display update mode, sample period and sample 
rate, and graphics on/off mode). These parameters are stored in non-volatile 
memory. When you start the PFA graphic display, it defaults to the settings last 
specified with the PF command, or last set inside the PFA display using the 
function keys. 


Appending the RUN argument to the PF command causes the PFA profiling to start 
from a running system. You must have a > RUN > prompt in order to use the PF 
RUN command. Use the GOP command if you want to start performance profiling 
from a stopped state (>BKM> prompt). 


PF RUN 
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The optional RUN keyword starts performance profiling and opens the PFA 
display for a target system currently running in Real-Time (>RUN> prompt) with 
no breakpoints installed. 


If the RUN keyword is not included, the emulator prompts you for a set of 
performance analysis parameters that are the defaults every time you start PFA 
with the PF RUN or GOP commands. 


Examples 


Table 3-4 PF Examples 


>RUN>PF RUN Starts profiling from a running system and starts the PFA 
histogram and chart display. 


>BKM>PF Prompts you to input the start-up performance analysis 
parameters as shown below. 


Tee eked Performance Range = 000A0000-O00DFFFF 

Dn sete Graph Type = sample last period/manual screen update 
ae Period = 1 Second 

Les Number of Samples/Sec = 2K/sec 

lapeenmecee Graphic Display = ON 

eee RUN 


enter number to edit or 6 to start > 


NOTE: Disable active breakpoints and tracing before using the PF RUN command. 
Use the BD (Breakpoint Disable) or RB (Remove Breakpoints) and DT (Disable 
Trace) commands. 


NOTE: The maximum performance analysis range is 256K; only symbols that are 
mapped into the specified range will be shown in the PFA display. Use the PFA 
range to filter out data symbols. 


NOTE: You can profile your code without using the graphics display. If you execute 
a PF RUN or GOP command with graphics off, the emulator issues a > PFA > 
prompt, signaling that the unit is sampling your code. From the > PFA > prompt, 
you may use the DIP command to disassemble code with profiling data. 
Additionally, you may issue a DM, SM, DR, SR, or DI command in the form of a 
special target snapshot from the >PFA> prompt. You may not issue a trace, 
breakpoint, or configuration command. 
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NOTE: Enter Ctrl+C from the >PFA> prompt to discontinue profiling, stop the 
target, and return to a >BKM> prompt. 


NOTE: Choosing Option 6, RUN, is equivalent to using the PF RUN command. 


See also the GOP (Start Performance Analysis) command, and the DIP 
(Disassemble with Code Coverage) command for more information. 


3.1.43 Project Upload (PJ UPLOAD) 


Syntax 


The PJ UPLOAD command displays all of the project settings that are currently 
loaded on your target board. 


PJ UPLOAD 


Example 


Output for the PJ UPLOAD command is several pages long, so only the first few 
lines of the command are shown here. 


>BKM>PJ UPLOAD 


REM ¥* RRR KK RK KKK KKK KKK KKK KK KK KK KKK KK KKK KKK KK KKK 


REM CF CONFIGURATION 


REM ¥* RRR KKK KKK RK KKK KKK KR KK RK KK KKK KK RK KK KK KK KKK 


CF TAR 8260 ; OPERATION 
CF SB SB ; OPERATION 
CF VECTOR HIGH ; OPERATION 
b cats der duahindins, calerandice betes She tides stele Gibemls Snscens tele kB hues aS contd 


3.1.44 Remove Software Breakpoint (RB) 


Syntax 


The RB command deletes a software breakpoint from a specified address. If no 
arguments are specified, then all breakpoints are removed. 


RB addr 


addr — This is the address of the breakpoint to remove. 


If no addr is specified, then all breakpoints are removed. 


61 


Wind River Workbench 
Command Reference , 2.6.1 


Example 


In this example, some previously set up breakpoints are displayed. Then the 
breakpoint at address 10000 is removed. Finally, the removal of the breakpoint is 
verified. Notice that the second code breakpoint becomes the first breakpoint after 
the RB command is issued. 

>BKM>db 

Software Code Breakpoints 


1. 00010000 count = 0001 actual = 0000 enabled 
2. 00010010 count = 0001 actual = 0000 enabled 


!INFO! - [msg82001] No internal hardware breakpoints installed 
>BKM>RB 10000 
>BKM>db 


Software Code Breakpoints 

1. 00010010 count = 0001 actual = 0000 enabled 

!INFO! - [msg82001] No internal hardware breakpoints installed 
>BKM> 


See also the DB (Display Breakpoints) command. 


3.1.45 Initialize Communications with Multiple Processors (RST or RSTIN) 


Syntax 


(Wind River ICE SX only) 


This command is for use during multi-core debugging. If you are debugging 
multiple processors on your scan chain, you can only use the IN command to 
initialize one processor at a time. The RST or RSTIN command will initialize all of 
the processors included on the scan chain simultaneously. The RST command 
attempts to initialize Background Mode communications for each processor on the 
scan chain. Once proper communications have been established, 

Wind River ICE SX transfers the Chip Select Table (which can be modified with the 
CS command) and the stored register settings (which can be modified with the SC 
command) to the target system via Background Mode. To initialize Background 
Mode communications for multiple processors without writing the Chip Select 
Table and register settings, use the RSTINN command. 


RST 
or 
RSTIN 


See the IN command for more information. 
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3.1.46 Only Initialize Communications with Multiple Processors (RSTINN) 


Syntax 


(Wind River ICE SX only) 


This command is for use during multi-core debugging. If you are debugging 
multiple processors on your scan chain, you can only use the INN command to put 
one processor at a time into background mode. The RSTINN command will put all 
of the processors included on the scan chain into background mode 
simultaneously. The RSTINN command is similar to the RST or RSTIN commands 
in that it places all of the processors on the scan chain in background mode. The 
difference is that the RSTINN command does not download any of the register 
settings or the chip-select settings that are stored in the Wind River ICE SX unit. 
The RSTINN command only places the target in background mode. If you use this 
command, your target settings and the settings stored in Wind River ICE SX may 
not be the same. Make sure that you are aware of this issue and try to keep your 
target settings and Wind River ICE SX settings in sync at all times. 


RSTINN 


See also the RST command and the INN command. 


3.1.47 Initialize and Trap Exceptions for Multiple Processors (RSTINE) 


(Wind River ICE SX only) 


This command is for use during multi-core debugging. The RSTINE command is 
similar to the INE command, a special initialization command that allows 

Wind River ICE SX to trap and decode exceptions that are not properly handled by 
the application code. The difference is that the RSTINE command performs the INE 
command on all of the processors in your scan chain simultaneously. 


You can only use this command from a >BKM> prompt or an >ERR> prompt. The 
RSTINE command cannot be used as a target snapshot. 


The RSTINE command performs the standard Background Mode initialization 
sequence (see the RST command for more information), including chip-select and 
SC register download. If valid Background Mode communications are established, 
the RSTINE command also initializes all exception vectors, not including the 
restart vector at the first eight longs, by writing a general exception address in each 
location in the exception vector table. 
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This address always points to the address immediately following the vector table. 
At this address,Wind River ICE SX sets a software breakpoint by inserting a BGND 
(Background Mode) instruction. 


After initializing with the RSTINE command and issuing a GO command, if you 
hit a breakpoint, Wind River ICE SX will determine if the breakpoint was at the 
location pointed to by the general exception. This is the address at the end of the 
event to which all uninitialized vectors point. If the target has broken at this 
location, Wind River ICE SX will upload the exception stack frame from the target 
and decode it for you. 


If you have taken the general exception and stopped at a breakpoint at the end of 
the event, Wind River ICE SX will display: 


«» A!BREAK! - Exception Trap Handler message 
«The location in memory of the exception stack frame 


« The Program Counter where the exception took place and/or the faulted 
address, if they are not the same 


« The exception type and vector offset 
« The target system’s registers at the time of the exception 


The RSTINE command assumes that the vector table is located at 0, unless you 
include a non-zero VBR as an optional parameter. If your vector table is in ROM, 
you can use the RSTINE feature by giving it an arbitrary RAM-based VBR, and 
then manually changing the VBR using the Set Register command (SR 
VBRRAM_address). 


You only need to use the RSTINE command once after system power-up because 
the installed vectors will remain loaded. 

Syntax 
RSTINE VBR_addr 


VBR_addr = this is an optional parameter that specifies a non-zero VBR. 


3.1.48 Set Breakpoint (SB) 


The SB command is used to set software breakpoints. These breakpoints can be 
standard software breakpoints or conditional breakpoints. Set a breakpoint by 
specifying only the address of the breakpoint, or add a second parameter count so 
that the break occurs only when the specified address is encountered count times. 
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The following is a list of the conditions that may be checked using the conditional 
SB command: 


« Check an address or data register for a specific value 
3 
* Check a memory location for a particular value EZ 


When entering the Execution Mode, the mode of operation message displayed by 
the GO command only indicates the mode that was started. If a conditional 
breakpoint is encountered during Execution Mode, the following message is 
returned: 


!BREAK! - Breakpoint at location 


Syntax 


For setting a standard breakpoint: 
SB addr 


addr — the address where the breakpoint is set. 


For setting a conditional breakpoint and checking a register value: 
SB addr count IF (R#== value) 


addr — This is the address where the breakpoint is set. 


count — This is an optional parameter, and it causes a break only when the 
specified address has been encountered count times. 


R# — This is number of the register to be checked, such as R9. 
value — This is the value that the data in the register must be equal to for the 
breakpoint to be hit. 
For setting a conditional breakpoint and checking a memory location: 
SB addr count IF (*data == value) 


addr — This is the address where the breakpoint is set. 


count — This is an optional parameter, and it causes a break only when the 
specified address is encountered count times. 


*data — This is the address of the data to be checked. 


value — This is the value that the data at the specified address must be equal to for 
the breakpoint to be hit. 
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For setting a conditional breakpoint to enable/disable tracing: 
SB addr count > TE 
addr — This is the address at which the breakpoint is set. 


count — This is an optional parameter, and it causes a break only when the 
specified address has been encountered count times. 


Example 


In this example, set a conditional breakpoint to trace a specific subroutine 
execution. First, set a conditional breakpoint that enables tracing during the 
subroutine. Also set a conditional breakpoint that disables tracing at the end of that 
subroutine. Finally, issue the GO command. Begin by displaying the code that will 
execute. Notice that when entering Execution Mode, the code will be running in 
real-time. Only during the subroutine will the code not run in real-time. 


BKM>DI 6000 5 


00060000 7003 moveg.1 #3,D1 
00060002 7201 moveq.1 #1.D1 
00060004 D4006FF8 bsr.w $7000 
00060008 E289 move.1 DO,D1 
OO006000A D401 add.b p1,D2 


BKM>DI 7000 4 


0007000 DO81 add.1 D1,D0 
0007002 E289 move.1 DO,D1 
0007004 D401 add.b D1,D2 
0007006 4E75 a 


BKM>SB 7000 > TE 
BKM>SB 7006 > TD 
BKM>SB 600A 
BKM>GO 6000 


RUN> 

!BREAK! - Breakpoint at 600A 

BKM>DTB 
4. 0007000 DO81 add.1 D1,D0 
3. 0007002 E289 move.1 DO,D1 
2. 0007004 D401 add.b D1,D2 
“is 0007006 4E75 rts 

BKM> 


See also the GO command, DI (Disassemble) command, and DT (Display Trace 
Buffer) command. 


3.1.49 Set Breakpoint —Temporary (SBT) 


The SBT command sets a temporary breakpoint in your code. Once the breakpoint 
is encountered the first time, it disappears. In terms of syntax and usage, the SBT 
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command can be used in exactly the same way as the SB command. See the SB 
command for more information about the syntax and use of this command. 


3.1.50 System Configuration (SC) 


Table 3-5 


Use the SC command to view and modify all of the internal registers in your 
system. The SC command operates ona host data file which retains register values, 
and it works with the SC GRP command in that the SC GRP command is needed to 
enable/disable register groups (including chip selects and register settings). 


If there are multiple processors included in your scan chain, the SC command will 
apply to the first processor included in your scan chain. The System Configuration 
settings for the second processor can be used by replacing SC with SC[1], and the 
settings for the third processor can be used by replacing SC with SC[2]. In the 
sections that follow describing all of the SC commands, make the replacement to 
SC[1] or SC[2] so that you can access the correct processor on your scan chain. 


The following table lists the many features and options supported by the SC 
command. 


Features and Options Supported by the SC Command 


SC Lists all the values stored in the host data file that belong to 
currently active groups. 


SC reg_name Prompts the user for input by first displaying the location and 
value of the specified register. 


SC reg_name value Allows the user to specify a value for a register without being 
prompted for the input. 


SC UPLOAD Uploads all of the current settings that are stored in the 
emulator to the host. This includes values for all registers, both 
the enabled and the disabled groups. 


SC ASM This command generates the assembly code for the enabled 
groups that would be required to initialize the registers during 
run time. This code may be captured by the host, assembled, 
and linked in with the rest of the system boot code. 


SC DEFAULT Resets all of the emulator settings in the host data file to the 
default factory settings. 
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The SC command allows users to display the current register settings and target 
settings stored in the emulator. To display the current data file settings at the 
prompt, type SC. The emulator displays the internal registers, which include the 
name of the register, its target address, and the value stored in the emulator. These 
values are displayed by group, and only those groups that are enabled using the 
CF GRP command are displayed. 


Syntax 
sc 
Example 


The following example displays the configuration settings for an 8260 target. 


>BKM>se 

KKK KKKKKKKEKKKKEKKEKK SIU KEK KKKKKKKKEKKKKEKK 

IMMR OFO101A8 O0F000000 SIUMCR OFO010000 0E240000 
SYPCR OFO10004 FFFFFFC3 SWSR OFO1000E 0000 

BCR OF010024 00000000 PPC_ACR OFO10028 02 
PPC_ALRH OF01002C 01234567 PPC_ALRL 0F010030 89ABCDEF 
LCL_ACR OF010034 02 LCL_ALRH OF010038 01234567 
LCL_ALRL OF01003C 89ABCDEF TESCR1 OF010040 80020000 
TESCR2 OF010044 00000000 LTESCR1 OF010048 00000000 
LTESCR2 OFO1004C 00000000 PDTEA OF010050 00000000 
PDTE OF010054 00 LDTEA OF010058 00000000 
LDTEM OFO1005C 00 

ooo--- CR for more information ------ 

KKK KKKKKKKEKKKKEKKEEKEK MEMC KEK KK KKK KKKEKKKKEKK 

ORO OF010104 FEO00856 BRO OF010100 FEOOO0801 
OR1 OFO1010C FFO000010 BR1 OFO10108 FC001801 
OR2 OF010114 FFOOOC80 BR2 OFO10110 00000041 
OR3 OF01011C FFOOOC80 BR3 OFO10118 01000041 
OR4 OF010124 FFCO1480 BR4 OFO10120 04001861 
OR5 OFO1012C FFFFO3F6 BR5 OF010128 22000801 
OR6 OF010134 FEO00856 BR6 OF010130 E0001801 
OR7 OF01013C FFFFO3F6 BR7 OF010138 21000801 
OR8 OF010144 00000000 BR8 OF010140 00000000 
ORY OF01014C FFFFO00O BR9 OF010148 60000081 
OR10 OF010154 FFFFOO00O BR1O OFO10150 700000A1 
OR11 OF01015C FFFFOO0O BR11 OFO10158 800000C1 
MAR OF010168 00000200 MAMR OF010170 00000000 
MBMR OF010174 00000000 MCMR OF010178 00000000 
MPTPR OF010184 3200 MDR OF010188 00000000 
PSDMR OF010190 418F48BA LSDMR OF010194 00000000 
PURT OF010198 08 PSRT OF01019C OE 

LURT OFO101A0 00 LSRT OFO101A4 00 
PCIBRO OFO101AC 00000000 PCIBR1 OF0101B0 00000000 
PCIMSKO OF0101C4 00000000 PCIMSK1 OF0101C8 00000000 
cocccH CR for more information ------ 

KEKE KKK KKKEKKKKEKKEKK ESTSDRAM KEK KK KKK KKKEKKKKEKK 

SDRMR OFO10C94 0000 SDPSRT OFO1019C OE 
PSDMR1 OF010190 016EB452 PSDMR2 OF010190 016EB452 
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PSDMR3 OF010190 296EB452 MEM1 00000000 FF 
PSDMR4 OF010190 296EB452 PSDMR5 0OF010190 096EB452 
MEM2 00000000 FF MEM3 00000001 FF 

MEM4 00000002 FF MEM5 00000003 FF 

MEM6 00000004 FF MEM7 00000005 FF 

MEM8 00000006 FF MEM9 00000007 FF 
PSDMR6 OF010190 096EB452 PSDMR7 OF010190 196EB452 
MEM10 00000000 FF PSDMR8 OF010190 596EB452 
PSDMR9Q OF010190 418F48BA 

cccccH CR for more information ------ 

KKK KKKKKKKEKKKKKKEKEK ESTLSDRAM KEK KKK KKKKKKKKEKEK 

SDLSRT OFO101A4 OE LSDMR1 OF010194 2886A552 
MEM11 04000000 FF LSDMR2 OF010194 0886A552 
MEM12 04000000 FF MEM13 04000001 FF 

MEM14 04000002 FF MEM15 04000003 FF 

MEM16 04000004 FF MEM17 04000005 FF 

MEM18 04000006 FF MEM19 04000007 FF 
LSDMR3 OF010194 1886A552 MEM2 0 04000000 FF 
LSDMR4 OF010194 4086A552 

>BKM> 


Modifying Values with the SC Command 


Syntax 


Any register can be modified by typing the SC command followed by the name of 
the register you want to modify. To set a value in Immediate Mode, the register 
name followed by a value will load the value into the host data file and then the 
emulator. By specifying the register name without a value, the emulator will 
prompt you for the new value by displaying the current settings and asking for 
input. You may also specify the form with which to input data. The default data 
input format is hex, but if you include a /B at the end of the command line, the 
input can be in binary format. 


SC regname /b 
regname — the name of the register to be modified 
/b — this is an optional parameter. If you do not include it, the data you enter for 


a register is in hex format. If you do include it, the data you enter for the register is 
in binary. 


Example 


To modify the module configuration register SYPCR in binary form, type: 
>BKM>SC SYPCR /B 


11111111110000110000000000000000 
SYPCR OF010004 FFFFFFC3> 
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The > positions the cursor just over the first bit of the SYPCR, and you can specify 
each bit by typing a 1 or a 0, or by pressing the spacebar. The spacebar indicates 

that you do not want to change the current setting of that bit. You have the option 
of modifying all of the bits, or changing only one or two bits by using the spacebar. 


Uploading the Emulator Settings 
To upload the settings that are stored in the emulator to your host computer, use 
the SC UPLOAD command. 


Syntax 


SC UPLOAD 


Generating Assembly Code using the SC Command 


The SC command can be used to turn all of your system configuration settings into 
assembly code. The assembly code that is generated may need to be edited to suit 
your specific programming needs, but the SC ASM command provides a starting 
point for generating assembly code that can be inserted into the code that you are 
using to bring up your board, such as a Board Support Package (BSP). 


Syntax 


Sc ASM 


Example 
The following example shows how the SC ASM command can be used. 


>BKM>sc asm 

lis r4,0x0F00 

ori r4,r4,0x0000 # r4 is the IMMR Base Address 
lis r12,0x0000 r12 is the SDRAM Base Address 
lis r3, 0x0E24 # SIUMCR 

ori r3,r3,0x0000 

lis r7,0x0001 


te 


ori r7,r7,0x0000 

stwx r3,xr7,r4 

lis v3, OxXFFFF # SYPCR 
ori r3,r3,0xFFC3 

lis r7,0x0001 

ori r7,r7,0x0004 

stwx r3,xr7,r4 

i: r3,0x0000 # SWSR 
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Restoring the Default Configuration Settings (SC DEFAULT) 


The SC DEFAULT command restores the default configuration settings for your 
processor. 


Syntax 


SC DEFAULT 


A CAUTION: This command causes any register settings or configuration options on 
your target to be overwritten by the emulator. Make sure that you save these 
settings to a file before issuing the SC DEFAULT command if you wish to preserve 
them. 


3.1.51 System Configuration Add/Delete (SCA/SCD) 


The SCA command is used to add custom registers to the existing set of system 
configuration registers. Custom registers can be any memory mapped peripheral 
register. Custom registers will be initialized with the IN command if the custom 
register group is enabled (CF GRP command). Custom registers are initialized in 
the sequence that they are originally created with the SCA command. The size 
(byte, word, or long word) of the register is determined by the number bytes in the 
value argument. Custom registers can be saved in the emulator with the SC SAVE 
command. 


Syntax 


SCA name_addr_value 


name = The name of the register. 
addr = The address of the register. 


value = The initial value of the register. 


Examples 


Create a custom register called IO1 at address 0x1000. Initialize this byte size 
register with a value of Oxde. 


SCA I01 1000 DE 


Create a custom register called IO2 at address 0x1010. Initialize this word size 
register with a value of 0x0. 


SCA I02 1010 0000 


71 


Wind River Workbench 
Command Reference , 2.6.1 


Create a custom register called IO3 at address 0x1020. Initialize this long word size 
register with a value of 0x12345678. 


SCA I03 1020 12345678 
Save these registers into the emulator NVRAM. 


SC SAVE 


Deleting Custom Registers (SCD) 


The SCD command is used to delete custom registers. 


Syntax 

scD name 

name = The name of the register. 
Example 


Delete custom register IO3. 
SCD 103 
Use the command SC UPLOAD CUSTOM to view the newly created registers. 


3.1.52 System Configuration —Target (SCT) 


The SCT command behaves similarly to the SC command, except that it affects only 
the system configuration settings on the target. It allows you to view and modify 
all of the internal registers on the target. 


If you use the SCT command to configure your target, be aware that any time you 
issue an IN command or power cycle the emulator, all of your target values get 
overwritten by the information that is stored in the emulator. For that reason it is 
best to make sure that your target settings and the settings stored in the emulator 
are the same whenever possible. 


The following table lists the many features and options supported by the SCT 
command. 
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Table 3-6 Features and Options Supported by the SCT Command 

SCT Lists all the current target settings for the enabled groups. Any 
value displayed that differs from the value stored in the 
emulator is highlighted with an asterisk. 

SCT COPY Copies the values that are stored on the target into the 
emulator. 

SCT regname Prompts the user for input by first displaying the current 
target settings. Entering a value changes the value on the target 
but not in the emulator. 

SCT regname value Sets the target register to the value specified. 

SCT DIFF This command displays the differences between the current 
target values and the values stored in the host data file. 

SCT UPLOAD Uploads the current target values to the host. 

SCT ASM Generates assembly code for the target settings. 

Most of the SCT commands work similarly to the SC commands described in 

3.1.50 System Configuration (SC), p.67. The only difference is that with the SCT 

commands the information is being taken from or added to the target rather than 

the emulator. See the SC commands for syntax. 

The SCT DIFF command is different from the other commands described in the SC 

section. The SCT DIFF command displays both the values stored in the emulator 

data file and the target values that differ. 
Syntax 

SCT DIFF 
Example 


The following example shows output from the SCT DIFF command. 
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SCT DIFF Command 
‘Tasks | Problems| Properties| Build Console| ErrorLog EEE > # | a\|2oe 1@| | | ml 
[Connected to PPC750FX] | 
[>BKM>sct ditt cS) 
‘REG NV ADDRESS NV VALUE TARGET ADDRESS TARGET VALUE | 
‘SCSOHADDR 14000010 FFoooooo 14000010 o7000000 
SCS1HADDR 14000210 oooooo00 14000210 oFoooooo 
SCS2LADDR 14000018 osoooo00 14000018 10000000 
‘SCS2HADDR 14000020 oooooo00 14000020 17000000 
SCS3LADDR 14000218 osooo000 14000218 1so00000 
SCS3HADDR 14000220 oooooo00 14000220 1Foooo00 
CS3LADDR 14000038 £0010000 14000038 Fooroooo 
‘CS3HADDR 14000040 E7010000 14000040 F70F0000 
BOOTLADDR 14000238 Fooroooo 14000238 FsoFroooo 
‘SD_CFG 14000448 O0C2E1D8 14000448 ooo2zcso4 
‘SD_ACTRL 1400047¢ oaoooo00 1400047¢ ozoo0000 
‘SDRAM_MODE3 14000474 03000000 14000474 oooooo00 
SDRAM_DUNO ooooo000 oooooo00 ooooo000 FF7SEFF6 
SDRAM_DUM1 oooooo0a oooooo00 ooooco0a FF78EFF6 
DEV_BANKO 1400045¢ FFFFCFFF 1400045¢ FFFFEF8F 
[DEV_BOOT 1400046 FFFF2FFO 1400046C FFFFEF8F 
DEV_CONTROL 140004c0 FFFFO300 140004c0 FFFFO700 
GPPIO 1400F100 5582FFFF 1400F 100 ooooos00 
GPPLEV 1400F110 FF4FFFO? 1400F110 oooooo00 
GPPVAL 1400F104 oooo0000 1400F104 FFBFFFOF 
GPPINTC 1400F108 oooo0000 1400F 108 FFFFFFOF 
MPPCTLO 1400F000 27777777 1400F000 oooooo0o 
MPPCTL1 1400F004 66660009 1400F004 oooooo00 
>BKE> 

. 
i ft 


3.1.53 System Configuration Group Add (SCGA) 


Syntax 


This command is used to create registers within a specified register group. The 

register group may be one that already exists, in which case the new register is just 
added to it, or if the register group does not exist it is created with the new register 
in it. Up to 32 custom register groups can be created, a total of 960 custom registers. 


scGa GroupName RegisterName Address Data Options 


GroupName — This is the name of the register group that the new register is added 
to. 


RegisterName — This is the name of the register that you are creating. 
Address — This is the address where the new register is located. 


Data — This is the data that is stored in the register you are creating. 
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Options — There are many options associated with the SCGA command. Table 3-7 


describes them. 


SCGA Options 


Option Name 


Description 


/cpur 


/hide 


/lendian 


/memr 


/no_in 


/r, /rw 


/Sz:B, /Sz:W, /S 
z:L, /Sz:D 


/va_dr 


/w, [rw 


lwo 


/w(nwf) 


/r(nwf) 


This option specifies that the register you are creating is a CPU core 
register (that is, SPR, or other non-memory mapped register.) 


This option means that the register is not visible when an SC or DR 
command is executed. It is only visible when an SC/SCG UPLOAD 
command is issued. 


This option signifies that the register you are creating is a little-endian 
register. It will only work on targets that are able to switch between 
little-endian and big-endian modes. 


This option signifies that the register is a memory mapped register. It is 
the default for self-defined registers. 


This option means that the register you are creating does not get set on 
the target during an IN sequence. 


These options specify Read Only and Read/Write registers. The default 
is /rw. 


These options force the size of the register to either Byte (8 bits), Word 
(16 bits), Long (32 bits), or Double (64 bits). The default register size is 
determined by the amount of characters used to specify the default 
value. 


This option is used on anchor registers to make them available ona DR 
command. 


These options are Write and Read/Write flags. The default is /rw. 


This option defines a fixed value register. That register is not affected by 
an SCT COPY command. 


This option specifies a write cycle (next write first.) It indicates that to 
write a value to the register, you need to write the following register 
value to the target first. 


This option specifies a read cycle (next write first.) It indicates that to 
read a register, you need to write the following register value to the 
target first. 
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SCGA Options 


Option Name Description 


/r(nwa) This option specifies a write cycle (next write after.) It indicates that to 
write a value to this register, you need to write the next register value to 
the target afterwards. 


Example 


The first example creates a new group called SIM_MMU, with a core register 
SIM_IBATOL included in it. 

>BKM>SCGA SIM_MMU SIM_IBATOL 4014 00000004 /cpur 

>BKM> 

The second example describes the /w(nwf) option. In this case, a register called 
PCICMD is created in register group MPC_PCI, however the option specifies that 
the register cannot be written to unless a write to the register ADDR_04, located in 
the same register group, is performed first. 


SCGA MPC_PCI PCICMD 80000CFC 0600 /w(nwf) /r(nwf) 
SCGA MPC_PCI ADDR_04 80000CF8 04000080 /wo /hide 


See also the SCGD command. 


3.1.54 System Configuration Group Delete (SCGD) 


Syntax 


This command allows you to delete specific registers in a group or all registers in 
a group. 


There are two ways to use this command. The first way causes all of the registers 
included in a register group to be deleted. The register group will still be available. 


SCGD Groupname 


Groupname — This is the name of the register group that the registers are to be 
deleted from. 


This second way to use the SCGD command is to specify a register within a register 
group to delete. In that case, only the specified register is deleted. 


SCGD Groupname Regname 


Groupname — This is the name of the group where the register to delete is located. 
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Regname — This is the name of the register to delete from register group 
Groupname. 


Example 


>BKM> SCGD SIM_MMU SIM_IBATOL 
>BKM> 


See also the SCGA command. 


3.1.55 Synchronize Cores (SCTRL) 


Syntax 


sctru [designator | au] [ENABLE|DISABLE] [au | co! Haut | TRIGGER] 


This command allows you to configure a group of cores for synchronized 
operation. This is a multi-core command and is only supported for the 
Wind River ICE SX. 


designator is the identification of the core you want to use, as specified in the board 
descriptor file. This option can also be set to ALL, meaning that all Microprocessor 
type devices being debugged at this time will be synchronized. For information on 
board descriptor files, see the Wind River Workbench On-Chip Debugging Guide: 
Board Descriptor Files. 


Specify ENABLE to enable synchronized activity; specify DISABLE to disable it. 
Specify GO to synchronize cores only on GO operations. 

Specify HALT to synchronize cores only on HALT operations. 

Specify ALL to synchronize cores on both GO and HALT operations. 

The TRIGGER option is not currently used. 


Example 


SCTRL ALL ENABLE ALL 


This command groups all Microprocessor-type devices on the scan chain for all 
synchronized actions. 


See also the GOS and HALTS commands. 
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3.1.56 Set Verbose On (SET VERBOSE ON) 


The SET VERBOSE ON command puts the emulator in verbose mode, which is 
useful when diagnosing communication problems with your target. When the 
emulator is not able to place your target in Background Mode after initialization, a 
failure message is displayed: 


Initializing Background Debug Mode...... Failed 


Additional information about the failure may be obtained by using the verbose 
mode at the > ERR > prompt. When in verbose mode, a number of pass/fail 
diagnostic messages are displayed as the emulator attempts to place the target in 
Background Mode. Using verbose mode will help you to diagnose why your target 
cannot be placed in Background Mode. 


NOTE: The tests described may vary depending on your target architecture. 


Initialization Tests for JTAG Targets 


Using JTAG communications, the following output occurs when a 
SET VERBOSE ON command is issued followed by an IN command: 


>BKM>set verbose on 

>BKM>in 

KKK KKK KKK KEK KK KKK KKK KKK KE KKK KKK KKK KKK KEK KEK KK KKK KKK KKK KKK KKK KKK EK KKK KKK KKK KKKEKKKK 
Wind River ICE Initialization Sequence. 

Copyright (c) Wind River Systems, Inc., 1999-2004. All rights reserved. 


KKK KKK KKK KKK KK KK KKK KKK KKK KK KKK KKK KR KKK KKK KK KK KKK KKK KK KKK KKK KKK KR KKK KKK KKK KKK KKK 


Support Expires....... 5/17/07 

Target Processor...... MPC8260 

Wind River ICE Group ID#=0 

Wind River ICE Serial#=w0000000 Firmware= vp2.3a 
Type CF For a Menu of Configuration Options 

Testing Communications to Hardware Interface...... Passed 
Checking Paddle Boards. sacie ak cea adee eee deee va ee Passed 
Dreving BRESET Co. be High. 2 .ew sie bee wee eS Passed 
Driving RESET 00 be LOW). 4060S«a-0b am deka See eee S Passed 
Waiting HRESET Low Acknowledge...............-.- Passed 
Attempting JTAG communication................-208- Passed 
Waiting for HRESET to be released................. Passed 
Testing for target STOP State..................06. Passed 
Comparing target CPU with CF setting.............. Passed 
Waiting for HRESET High Acknowledge............. Passed 
Chreie hag Rs ar he acre aS wowed we ac atl a Oe alee Passed 
Testing JTAG Communication............. 0c ee ee eee Passed 
Attempting to Locate IMMR register................ Passed 
Loading Internal Registers............ eee eee eee Passed 
Testing JTAG Communication.............0 eee eee eee Passed 
Attempting to restore CPU context................. Passed 
>BKM> 
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The following is a brief description of the tests with some possible reasons why 
each test would fail. 


Testing Communications to Hardware Interface 


This tests the hardware connectivity, and examines the communications path 
between the host and the emulator. If the test fails, ensure that you have the power 
properly connected and turned on, that the emulator is correctly connected to the 
host computer, and that your emulator hardware is properly connected to the 
target. 


Checking Paddle Board 


If this test fails, verify that the paddle board is correctly connected to the emulator 
unit. If it fails, it is likely that there is a problem with this paddle board. Verify that 
the connection between the paddle board and the unit is secure, and that all of the 
pins are intact. 


Driving HRESET to be High 


This function tests the RESET signal of the JTAG connector to verify that it is high. 
The emulator is not driving the RESET signal during this test, so the target must 
drive the RESET signal via a pull-up resistor. If this test fails, check to see if the 
target board has a pull-up resistor on the RESET signal to the HRESET pin of the 
JTAG connector. Also, check the target board reset logic and verify that it is not 
continually driving RESET low. 


Driving HRESET to be Low 


The RESET signal is a bi-directional signal for your unit. The emulator drives the 
RESET signal low and clocks it back in to verify that it is low. If this test fails, you 
may have contention on your reset signal. Check to see if a device on your target 
board is continually driving reset high. Verify that the device on your target board 
that is driving the RESET signal is an open collector device with a pull-up resistor. 


Attempting JTAG communication 


During this test, the emulator stops the processor and attempts to establish JTAG 
communications. If this fails, check to see that your hardware is connected 
properly, and that the tests preceding this one passed accordingly. It is also possible 
that there is contention on your board. 
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Waiting for HRESET to be released 


The emulator only drives RESET low for a specified period of time. After RESET is 
driven low for the allotted time, it tri-states the RESET driver and clocks the RESET 
signal back in to see if the RESET signal went high. It continues to check for RESET 
to go high until is sees it go high or until you type Ctrl+X. If this test fails, check to 
see if your target board reset logic is still driving the RESET signal low. Also check 
that your target board has a pull-up resistor to drive RESET high. 


Testing for target STOP State 


This test verifies that the processor stopped during the preceding JTAG 
Communications test by polling the processor status. If the target is still running, 
this test fails. 


Comparing Target CPU With CF Setting 


This test verifies that you are properly configured for the appropriate target 
processor by comparing the processor type on your target with the processor type 
specified in your board file. If the test fails, use the CF TAR command to properly 
configure your target. For example, if this test fails and you are using an MPC8260 
board, execute a CF TAR 8260 command sequence in the OCD Command Shell. 


Testing JTAG Communication 


This tests the JTAG communication using a slow internal clock rate. 


Attempting to Locate IMMR register 


This test only completes for PowerPC 82xx targets. It attempts to verify the location 
of the IMMR register, which serves as a pointer to all of the other registers. If it fails, 
none of the internal registers are accessible. If the test fails, check the reset 
configuration word, located in the Flash, and ensure that it is set to the correct 
value. 


Loading Internal Registers 


Once background communications are established, the emulator downloads 
register values from the debugger NV-RAM to the target. It will only download 
register values for those register groups that are enabled. The CF GRP command 
can be used to view and change the groups that are enabled. If this test fails, verify 
that your register values are correct. 
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Testing JTAG Communication 


This test examines the JTAG Communication between the emulator and the target 
using the internal clock rate for which the emulator is configured. If this test fails, 
use the CF CLK command to lower the internal clock rate. 


Attempting to restore CPU context 


This test restores the processor scan chains. 


Initialization Tests for BDM Targets 


Using BDM communications, the following output occurs when a 
SET VERBOSE ON command is issued followed by an IN command: 


>BKM>set verbose on 

>BKM>in 

KEK KKK KKK KKK KKK KKK KKK KEK KKK KKK KKK KK KEK KKK KKK KKK KKK KKK KKK KKK KEK KKK KKK KKEKKKKEKKAEKK 
Wind River ICE Initialization Sequence. 

Copyright (c) Wind River Systems, Inc., 1999-2004. All rights reserved. 


KR KKK KKK KKK KK KKK KKK KKK KKK KK KKK KKK KK KK KKK KK KK KKK KKK KK KKK KKK KKK KKK KK KKK KKK KKK KEK 


Support Expires....... 5/17/07 

Target Processor...... MPC860 

Wind River ICE Group ID#=0 

Wind River ICE Serial#=w0000000 Firmware= vp2.3a 
Type CF For a Menu of Configuration Options 

Testing Wind River ICE Communication........... Passed 
DYivinig HRESET to be High: sa ..kudd vee dek ees Passed 
Driving HRESET to be GOW tas c< saeco eee Oe, Passed 
Waiting for HRESET to be Released........... Passed 
Testing for target FREEZE State............. Passed 
Attempting to Enable Background Mode........ Passed 
Testing BDM Communication................... Passed 
Loading Internal Registers...............4.. Passed 
Testing BDM Communication................... Passed 
Tnitielizing CPU TeGiSterss ..¢ec.. cd cves aves Passed 
>BKM> 


Here is a brief description of the tests with reasons why each test might fail. 


Testing Communication 


This item checks the hardware connectivity, and examines the communications 
path between the host and the emulator. If this fails, ensure that power is properly 
connected and turned on, that the emulator is correctly connected to the host 
computer, and that your emulator hardware is properly connected to the target. 


Driving HRESET to be High 


This function tests the RESET signal of the BDM connector to verify that it is high. 
The emulator is not driving the RESET signal during this test, so the target must 
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drive the RESET signal via a pull-up resistor. If this test fails, check to see if the 
target board has a pull-up resistor on the RESET signal to the HRESET pin of the 
BDM connector. Also, check the target board reset logic and verify that it is not 
continually driving reset low. 


Driving HRESET to be Low 


The RESET signal is a bi-directional signal for your unit. The emulator drives the 
RESET signal low and clocks it back in to verify that it is low. If this test fails, you 
may have contention on your RESET signal. Check to see if a device on your target 
board is continually driving RESET high. Verify that the device on your target 
board that is driving the RESET signal is an open collector device with a pull-up 
resistor. 


Waiting for HRESET to be Released 


The emulator only drives RESET low for a specified period of time. After the 
debugger has driven RESET low for the allotted time, it tri-states the RESET driver 
and clocks the RESET signal back in to see if the signal went high. It continues to 
check for RESET to go high until is sees it go high or until you type Ctrl+X. If this 
test fails, check to see if your target board reset logic is still driving the RESET 
signal low. Also check that your target board has a pull-up resistor to drive RESET 
high. 


Testing for target FREEZE State 


This test determines whether or not the processor is in Freeze state. The emulator 
monitors the VFLS signals to see if the processor is frozen. These signals are high 
if the processor is in the Freeze state. If the Freeze signal is being used instead of 
the VFLS signals, then the emulator checks that the Freeze signal is high. This test 
usually fails if the Hardware Reset Configuration word is incorrect. Verify that bits 
D9 and D10 of the Reset Configuration Word are driven high and bits D11 and D12 
are driven low during the reset. Bits D9 and D10 select the VFLS functionality on 
the appropriate multifunction pins. 


Attempting to Enable Background Mode 


The emulator checks to make sure the processor is in background mode. The 
emulator also initializes registers in accordance with its CF parameters. 


Testing BDM Communication 


The emulator tests the serial communications channel by writing a test pattern to 
register ROO and then reading register ROO to verify that the write was correct. 
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Loading Internal Registers 


The emulator initializes the internal target registers. This test is not performed if an 

INN command is used to initialize the target. The emulator initializes all registers 

in enabled register groups. Register groups can be enabled or disabled with the 
CF GRP command. 


Testing BDM Communication 


The emulator test the serial communication channel a second time by writing a test 
pattern to register ROO and then reading register ROO to verify that the write was 
correct. This test is repeated because the debug port may be inadvertently disabled 
by the previous tests. If this test fails, check to make sure that the initial value for 
the SUIMCR register does not disable the debug port. 


Initializing CPU registers 


The emulator initializes CPU registers that are loaded. If this fails, check your 
register values. 


3.1.57 Show History (SH) 


The emulator automatically logs all of its command responses and error messages 
in an internal buffer. The SH command allows you to display this text buffer, thus 
displaying a history of the command responses. 


Essentially, any ASCII characters that the emulator transmits to a host PC, either in 
direct communication mode or as a response to a source-level debugger command, 
are logged in this buffer. The system does not log commands that were received 
from the host, only responses. In most cases, the emulator echoes back the received 
command before it processes it, so that this echo of the original command is in the 
history buffer. 


Binary interfaces to source-level debuggers denote a special case of the SH 
command. The emulator does not log its binary response to the source-level 
debugger command; however, before the unit sends its binary packet to the host, 
it logs the ASCII equivalent response in the history buffer. This can be extremely 
useful in trapping target problems that may be hidden by the source debugger 
interface. For example, the target may take a double bus fault, but the emulator has 
no way to communicate this specific problem to the host debugger. The SH 
command allows you to view the output history log, which in this case lets you 
display the entire ASCII double bus fault message as you would have seen it had 
you been in direct ASCII communication mode. 
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The emulator uses a 2K circular text buffer to log the history. The SH command 
allows you to display the log backward (B) or forward (F) in the buffer. The default 
is to display the log backward. The SH command also takes the number of lines 
you wish to display as an optional parameter. If you use this parameter, the SH 
command displays that number of lines forward or backward from the current 
buffer pointer. The SH command, without the lines parameter, resets the buffer 
pointer to the very last command that was logged. A carriage return immediately 
following an SH command displays the next page of the buffer, either forward or 
backward, depending on the previous SH command. The SH command is valid 
from a > BKM >, > ERR >, >RUN> or >TRC> prompt. 


Syntax 


SHdirection number_of_lines 


direction — This determines whether you display the log forward (F) or backward 
(B). By default this option is set to B. Do not leave a space between SH and the 
direction parameter. 


number_of_units — This specifies the number of logged ASCII lines you wish to 
display. 


A carriage return immediately following a SH command repeats the SH command, 
while updating the buffer pointer either forward or backward. 


Examples 


Table 3-8 SH Examples 


>BKM>SH Resets the buffer pointer to the last command that 
was logged and displays a full page of the log, 
backward. 

>BKM>ENTER Displays the next page of the log, backwards. 

>BKM>SHF 8 Displays the next eight lines in the buffer, forward. 


3.1.58 Single-Step Instruction(s) (Sl) 
The Single-Step command steps the emulator count number of target instructions. 


The default count is one instruction. There are optional arguments for displaying 
registers and disassembling the last instruction that was just executed. 


84 


Syntax 


3 Low-Level Commands 
3.1 Low-Level Commands 


SIarglarg2 count 
arg1 — This argument is the DR command, which displays all registers. 


arg2 — This argument is the DI command, which disassembles the last instruction 
executed. 


count — This is the number of target instructions to execute. 


Note that the positions of arg1 and arg2 can be reversed with no difference in the 
output. 


Example 


In this example, single-step the target for one instruction. View the contents of the 
registers and the instruction that was executed. 


BKM>SIDIDR 

DO = 00000000 D1 = 00000000 D2 = 00000000 D3 = 00000000 
D4 = 00000000 D5 = 00000000 Dé = 00000000 D7 = 00000000 
AO = 00200000 Al = 00000000 A2 = 00000000 A3 = 00000000 
A4 = 00000000 A5 = 00000000 A6 = 00000000 A7 = 00000000 
USP= 00000000 SSP= 00000000 PC = 00000000 SR = 0000 


VBR= 00000000 SFC = 0000 DFC = 0000 


MOVE.W #$7F00, (AQ) 
BKM> 


3.1.59 Set Memory (SM) 


Syntax 


This command sets memory with data in byte, word (default), or long format, 
starting at addr. 


Using the syntax indicated below, the SM command allows both memory-relative 
and register-relative addressing. 


The SM command differs from the MM command in that the MM command only 
modifies the memory at a specified address whereas the SM command reads back 
the value to verify that it wrote correctly. 


sMunit base_addr data optional_data2 optional_dataN 


unit — This parameter can be either B (byte), W (word), or L (long). By default, this 
option is set to Word. 


addr — This parameter is the target address at which to begin setting data. 
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data — This parameter can be one or more Hex strings of data in units. 


The Set Memory command can also take an indirect address and a register-relative 
address as parameters. The syntax is as follows: 


sm(“addr) 


Example 1 


In this example, display the contents of memory both before and after setting three 
bytes of memory to the specified values: 

BKM>DMB 200010 3 

200010: FF OF 00 

BKM>SMB 200010 0B 7F 34 

BKM>DMB 200010 3 

200010: 0B 7F 34 

BKM> 

There is also an optional Task Identifier (tid=) field for Linux. The Task Identifier 
relates the address to the Linux Process Identifier. Some PowerPC targets (such as 
the PPC405) employ a PID register, which is not the same as the Linux pid and tid. 
When you need to cross reference a Linux User Space address, assuming the 
MMUL tables have been preset to know the PIDs for a given operating system, you 
may enter a relative address with the value to access the correct physical address 
on the target. Up to five (0,1,2...4) PID cross-referenced addresses (in the MMUL 
table) are allowed. 


Example 2: 
>BKM>sml tid=1 5500 12345678 
In this example, the TID is 1, the Logical Address is 0x5500, and the value is 
12345678. 


NOTE: Linux assigns TIDs as needed. Use the Linux command ps -a at a Linux 
shell to get the list of Process IDs for all user processes. 


See also the DM (Display Memory) command and the MM (Memory Modify) 
command. 


3.1.60 Set Memory Double (SMD) 


The SMD command is for supported architectures. This command is similar to the 
SM command in that it sets memory with data starting at addr. However, it will 
write data with full 64-bit write operations. 
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3 Low-Level Commands 
3.1 Low-Level Commands 


Using the syntax indicated below, the SMD command allows both 
memory-relative and register-relative addressing. 


smp addr data 


addr — This is the base address at which to start adding data. 
data — This is the data to be added. 


Example 


The following example first reads the memory at location 200010, then writes some 
data to the location, and then reads it again. 


>BKM>dmd 200010 3 

00200010: FFFFDFFFFFFFFFFF FFFFFFFFFFFFFFFF .........-+-2-08- 
00200020: FFFFFFFFFFFFFFFD ............-48- 

>BKM>smd 200010 OB 7F 34 

>BKM>dmd 200010 3 

00200010: OO0D0000000000000B OOD000000000007F  ..... eee eee eee. 
00200020: 0000000000000034 3 ....... Oi wa shel 

>BKM> 


3.1.61 Set Register (SR) 


Syntax 


The SR command sets the register reg_name to the values designated by hex_string. 
The all parameter is useful when clearing all of the registers. 


SR reg_namel datal reg_nameX dataX 


reg_name1 — The name of the first register to have data added to it. 
data1 — The data to add to reg_namel1. 


The reg_nameX dataX can be repeated for as many registers as you want to modify 
at one time. 


The other syntax that can be used for this command is shown below. 


Example 


In this example, display registers ROO and RO1. Then modify the values of those 
registers using the SR command, then display them again to verify their contents. 
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>BKM>dr r00 r01 

ROO = 00000000 RO1 = 00001234 
>BKM>sr r00 12345678 r01 88888888 
>BKM>dr r00 r01 

ROO = 12345678 RO1 = 88888888 
>BKM> 


See also the DR (Display Registers) command. 


3.1.62 Search for String (SS) 


Syntax 


The Search for String command allows you to search for a string in memory. The 
string may be an ASCII string or Hex data. The search begins at strt_addr and ends 
at end_addr. If the string exists more than once in the block of memory, pressing 
ENTER continues the search. 


ssunit strt_addr end_addr string 


unit — This parameter can be either H (hex) or A (ASCII). By default, this option is 
set to ASCII. 


strt_addr — This option is the starting address of the search. 
end_addr — This option is the ending address of the search. 


string — This is the string to search for. 


Example 


In this example, search for the ASCH string hello between 10000H and 12000H. 
Find one string and continue the search until all of the locations are checked. There 
is only one occurrence of this string in the memory that is searched. 


BKM>SSA 10000 12000 hello 
String found at 1000f 
BKM>cr 

String not found 

BKM> 


3.1.68 SY Commands 


The following SY commands are low-level system commands used to provide 
detailed control and diagnostic information obtained via the JTAG scan chain 
information. 
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SY 


3 Low-Level Commands 
3.1 Low-Level Commands 


NOTE: Some JTAG diagnostic commands are specific for different processors, and 
do not necessarily support them all. Refer to command descriptions for 
information on which processors each command supports. 


For PowerPC processors, entering SY with no arguments lists all available SY 
commands and their syntax. These will vary by target processor. The following 
example shows the output displayed after an SY command on a PPC750FX target. 


>BKM>sy 

0. SYNC 

1. REV 

2. pci mapa 

3. pci mapb 

4. pei rega 

5. pei regb 

6. JTAG stat 

7. JTAG rd 

8. JTAG ID 

9. JTAG sca 

10. JTAG wr<v><l><c><d> 
11. BS hrst 

12. BS 

13. BKM bsdl 

14. BKM 

15. PROMPT 

16. CHAIN 

17. MAP 

18. PROG1 {ADDR} 
19. PROG2 {ADDR} 
20. PROG3 {ADDR} 
21. CMD {-l} <v> 
22. BIST {-l} <v> 
23. BAT 

24. 

25. REPORT 

26. CLAMP INIT 
27. CLAMP 

28. CONNECT 

29. READFPU 

30. UMM <addr> <v> 
31. FREERUN <addr> 
32. HRESET LOW 
33. HRESET HIGH 
34. 107 sdram 

35. CACHE L1 

36. CACHE L2 

37. CACHE L3 


Synchronize the emulator wi 


Poll all 32 
Poll all 32 
Display the 
Display the 
Display all 


Display the 


th the target. 


PVR Register value. 


devices on the MAP_A bus. 
devices on the MAP_B bus. 
MAP_A PCI bridge Registers. 
MAP_B PCI bridge Registers. 


types of status 


for multiple devices 


Read the Boundary scan chain for this device 
Read the device ID for this device 


: Analyze the topology of a mutiple device chain 
: Write BSDL bit <v> to level <l> control <c> 


direction <d>. 
Display Boundary Info while HRESET is asserted 
Display Boundary Information. 


: Toggle the BSDL external pins. 
Toggle the JTAG external pins. 
Force the prompt to BKM mode. 


Display CS 


RSTCONF <val><size><Ftype><PSpan> 
Display COP/JTAG -> Core In 


Freeze the 
Freeze the 
Synchronize 


Run the pro 


: Assert and 


Release the 
Initialize 
Display L1 
Display L2 
Display L3 


mapping. 


Program the PQII 


cores clocks and 
cores clocks and 
the emulator wi 


Display the length of the SELECTED chain. 


Download basic program to target at ADDR. 
Download read/write program 
Download exception program 

Issue a COP command v = COP 
Issue a JTAG command v = CO 


to target at ADDR. 
to target at ADDR. 
command, -1l = loop. 
P command, -l = loop. 


Display the BAT registers formatted. 


Conf Word. 

formation. 

release HRESET 

hold HRESET 

th the TAP controller 


Display Floating Point Registers 
Unaligned Modify Memory Long (32bit only). 


cessor without trapping exceptions. 
HOLD the HRESET signals. 


HRESET signal. 
MPC107 for SDRAM 
cache data 
cache data 
cache data 


using mapB. 
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38. PQII <immr location> 


>BKM> 


: Fined the IMMR and disable the watchdog timer. 


This command obtains the BAT registers and formats them to determine memory 
blocks, sizes, and configurations. It is for use with PowerPC processors. 


Name PageIndex 


IBATO £££00000 
IBAT1 00000000 
IBAT2 £e000000 
IBAT3 00000000 
DBATO £££00000 
DBAT1 00000000 
DBAT2 £e000000 
DBAT3 00000000 


BaseAddress 
f£££00000 
00000000 
£e000000 
00000000 
f£££00000 
00000000 
£e000000 
00000000 


Size 
16MEG 
128MEG 
16MEG 
128K 
16MEG 
128MEG 
16MEG 
128K 


O:0'O::0).0:0 O10 Ss} 


OCRRROROFRH 


COFCOOFOC®R 


ooo ononononone) 


Access Protection 

Supr & User Read Only 
Supr & User Read/Write 
Supr & User Read/Write 
Disabled 

Supr & User Read Only 
Supr & User Read/Write 
Supr & User Read/Write 
Disabled 


Scans out the boundary scan chain and displays most signals and their logic state. 
For use with PowerPC processors. The (s) indicates a static signal read directly 
from the pin. All others are based on the last clock before the processor has 
stopped, as shown below. 


Scan Address 
QREQ 

MCP (s) 
HRESET (s) 
INT (S) 
ABB 

DBG (s) 

TS 

TEA (s) 

BG (s) 
DRTRY (s) 
SMI (s) 
CKSTPOUT 
PLLO..3(s) 
TSIZ 

TTx 


Wool 


EELCELLS 

LOW QACK(s) 
HGH SRESET(s) 
HGH CKSTPIN(s) 
OW AACK(s) 


GH DBB 
GH DBDIS(s) 
HGH TA(s 
G 
O 


H BR 

WwW GBL 

H ARTRY 
HGH TLBSYNC 
LOW 

4 133Mhz 
0 

1 


G 
G 


LOW 


Hou ow ou ou ow wea 


ol 


QAAADAAAAAAA 


This command scans and counts each bit throughout the scan chain to determine 
its exact length. This is helpful to determine which processor you are working 
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SY CMD value 


SY PCI 


3 Low-Level Commands 
3.1 Low-Level Commands 


with. Some PowerPC processors have scan chains that are not supported. This will 
be the quickest indication that the processor and emulator are not compatible. The 
command can be used with PowerPC processors. 


Chain Length in bit = 7488 


This command provides a way to send JTAG commands directly to the JTAG 
interface. The value(s) are any of the JTAG commands supported by the processor 
you are working with. For use with PowerPC processors. 


CPU is Stopped, BIST is Complete 


Displays the MPC 106 configuration registers in big endian mode. This command 
also displays the current map being used. For use with PowerPC processors. 


Using MAP b........ 


Device and Vendor ID = 00021057 Memory Starting Address = ffff0800 
Memory Ending Address = f£ff0f07 Processor Configure #1 = ££341c48 
Processor Configure #2 = 00000000 Memory Configure #1 = ££b80003 
Memory Configure #2 = 0000020c Memory Configure #3 = 02300000 
Memory Configure #4 = 25402220 Memory Bank Enable = 03 

PCI Status/Command = 00800006 Power Management = dd000000 


PCI Error Address 00000000 


System Program (SY PROG) 


Syntax 


The SY PROG command is used to write a tight loop of code at a given address. 
This command is used to see if the processor is operational (can execute code out 
of internal RAM, for example). The SY PROG1 command writes a tight loop 
consisting of NOPs followed by a branch back. The SY PROG2 command writes a 
tight loop to load and store instructions. 


This command is only supported for PowerPC microprocessors. 


SY PROGH 
n=1,2 
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Examples 


Write a NOP loop to internal RAM, located at 0x2000 offset from IMMR register 
(Oxff000000): 


BKM>sy progl1 ££002000 
Write Load/Store loop to external RAM located at 0x40000: 


BKM>sy prog2 40000 


SY REV 


This command scans out the PVR register of the processor and formats the value 
into the product name and revision. For use with PowerPC processors. 


Example 
>BKM>sy rev 


Part PVR Value = 0x70000202, IBM 750FX2 Revision 2.2 
>BKM> 


SYNC or SY PROMPT 


When the emulator enters error mode, the JTAG interface can re-synchronize and 
then the scan chain can be read. In some cases, this information can help diagnose 
the reason for an error condition. This can be used with PowerPC processors. 


Example 


>BKM>sy prompt 
Synchronization Complete. Current PC = Oxfff00100 
>BKM> 


System Map (SY MAP) 


The SY MAP command provides the chip select start and end addresses for each 
chip select when using the emulator with a PowerPC 8xx target. 


Syntax 


SY MAP 


92 


3 Low-Level Commands 
3.1 Low-Level Commands 


Example 


BKM> sy map 
IMMR = FFOO0000 -> FFOO3FFF 


CSO = FFFO0000 -> FFFFFFFF 

CS1 = FFEQ0000 -> FFE7FFFF 
CS2 = 30000000 -> 3000FFFF 

CS3 = 04000000 -> O0407FFFF 

cSs4 = 00000000 -> O03FFFFF 

CS5 = DISABLED. . 

CS6 = DISABLED. . 

CS7 = DISABLED. . 

BKM> 


3.1.64 Trace Disable (TD) 


Syntax 


The TD command disables the non-real-time software trace. Software trace is 
disabled by default. Note that software trace is automatically activated (and a 
>TRC> prompt appears) if you set a software breakpoint on ROM code ora 
software data breakpoint. 


TD 


No parameters are required for this command. 


3.1.65 Target Diagnostic Functions (TDF) 


The target diagnostic functions are similar to the diagnostic functions (DF 
commands) described previously in this chapter. The difference is that in this case, 
the diagnostics are run directly on the target instead of through the emulator. 


Typing TDF LIST at the >BKM> prompt displays a list of all of the available target 
diagnostic functions. Typing TDF VERSION displays the versions of each of the 
target diagnostic functions. 


The code that runs the diagnostic will be loaded at the memory address indicated 
by the CF WSPACE configuration option. Make sure you are not trying to test the 
same memory area that you are specifying in CF WSPACE. 


There are five target diagnostic function tests available. 


TDF 0 — Single-pass Simple Memory Test 


This diagnostic function runs a simple RAM test through a single pass only. 
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Syntax 
TDF unit 0 startaddress endaddress 
unit — This can be either B (Byte), W (Word), or L (Long). 
startaddress — This is the address where the diagnostic test is to start. 


endaddress — This is the address where the diagnostic test is to finish. 


Example 
>BKM>td£ 0 1000 1100 
Single-pass Simple Memory Test loaded. Now executing TDF. 


Test Complete 
>BKM> 


TDF 1 — Continuous Single Memory Test 
The TDF 1 command runs a simple RAM test continuously. This test can be 
stopped by typing Ctrl+X. 
Syntax 
TDF unit 1 startaddress endaddress 
unit — This can be either B (Byte), W (Word), or L (Long). 
startaddress — This is the address where the diagnostic test is to start. 


endaddress — This is the address where the diagnostic test is to finish. 


Example 


>BKM>TDF 1 1000 1100 


Continuous Simple Memory Test loaded. Now executing TDF. 
test looping press “X to abort pass count 1 
test looping press *X to abort pass count 2 
test looping press *X to abort pass count 3 
test looping press *“X to abort pass count 4 
test looping press *“X to abort pass count 5 
test looping press *X to abort pass count 6 
test looping press “X to abort pass count 7 
test looping press “X to abort pass count 8 
test looping press *“X to abort pass count 9 
test looping press *X to abort pass count 10 
test looping press *X to abort pass count 11 
test looping press “X to abort pass count 12 
test looping press *X to abort pass count 13 
test looping press *X to abort pass count 14 
test looping press *X to abort pass count 15 
test looping press *X to abort pass count 16 
test looping press *X to abort pass count 17 
>BKM> 
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TDF 2 — Complete Memory Test, Single Pass 


The TDF 2 command runs a complete RAM Test for a single pass. 


Syntax 


TDF unit 2 startaddress endaddress 


unit — This can be either B (Byte), W (Word), or L (Long). 


startaddress — This is the address where the diagnostic test is to start. 


endaddress — This is the address where the diagnostic test is to finish. 


Example 
>BKM>TDF 2 1000 1100 
Single-pass Complete Memory Test loaded. Now executing 
TDF. 


Test Complete 
>BKM> 


TDF 3 — Complete Memory Test, Continuous 


The TDF 3 command runs a complete RAM Test continuously. 


Syntax 


TDFunit 3 startaddress endaddress 


unit — This can be either B (Byte), W (Word), or L (Long). 


startaddress — This is the address where the diagnostic test is to start. 


endaddress — This is the address where the diagnostic test is to finish. 


Example 


>BKM>tdf 3 1000 1100 


Continuous Complete Memory Test loaded. Now executing TDF. 
test looping press *X to abort pass count 1 
test looping press *X to abort pass count 2 
test looping press *“X to abort pass count 3 
test looping press “X to abort pass count 4 
test looping press “X to abort pass count 5 
test looping press “X to abort pass count 6 
test looping press “X to abort pass count 7 
test looping press “X to abort pass count 8 
test looping press *“X to abort pass count 9 
>BKM> 
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TDF 4 — CRC Test 


The TDF 4 command runs a CRC test over a specified range of memory. 


Syntax 
TDF unit 4 startaddress endaddress 
unit — This can be either B (Byte), W (Word), or L (Long). 
startaddress — This is the address where the diagnostic test is to start. 


endaddress — This is the address where the diagnostic test is to finish. 


Example 
>BKM>tdf 4 1000 1100 
CRC-16 Test loaded. Now executing TDF. 


Completed... CRC-16 Value = 101 
>BKM> 


3.1.66 Target Diagnostic Function, Double (TDFD) 


The TDFD command is for JTAG processors only. This command performs the 
same functions as the TDF commands with full 64-bit read/write operations. 
Syntax 


The syntax for the TDFD command is the same as the syntax for all of the other TDF 
commands, except that the unit option is not available since the unit is already set 
to double with this command. 


TDFD testnumber startaddress endaddress 


testnumber — This is the number of the diagnostic test you wish to run. There are 
five target diagnostic tests available, labelled 0 - 4. 


startaddress — This is the address where the diagnostic test is to start. 
endaddress — This is the address where the diagnostic test is to finish. 


See the TDF commands for more information. 
3.1.67 Trace Enable (TE) 


The TE command enables the non real-time software trace. Software trace is 
disabled by default. Note that software trace is automatically activated (a >TRC> 
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Syntax 


3 Low-Level Commands 
3.1 Low-Level Commands 


prompt appears) if you set a software breakpoint on ROM code or a software data 
breakpoint. 


TE 


No arguments are required for this command. See also the CF (Configure) 
command. 


3.1.68 TF Flash Configure Command (TF) 


The TF commands are associated with programming flash memory. There are a 
number of usable TF commands, each with specific functions, as described in this 
section. 


Target Flash Configure (TF CONF) 


Syntax 


Use the TF CONF command to configure the emulator for flash programming and 
erasing. This command allows you to specify the device type, target RAM 
workspace, and base address. The actual erase and program instructions are 
downloaded into the RAM workspace. The target processor then executes the 
erase and program algorithms out of the RAM workspace. 


There are two different ways to use the TF CONF command. The first way is to use 
the following syntax. 


TF CONF 


With this syntax, you are prompted to specify the start address of the RAM 
workspace, and the start address of the flash bank on your target. 


NOTE: To use this command syntax to configure the emulator for flash 
programming, first use the TF DEVICE command to specify the flash device on 
your target and the TF CONF SIZE command to specify the RAM workspace size. 


The syntax for the second method of using the TF CONF command is as follows: 
TF CONF device_number RAM_workspace_address workspace_size base_address 


device_number — This selects a device from a list of available devices. This is the 
same number that is used with the TF DEVICE command. 
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RAM_workspace_address — This is the base address for the target RAM workspace. 


workspace_size — This is the size (in bytes) required for the erase and program 
algorithm in RAM. 


base_address — The is the base address (in hex) of the Flash device. 


Example 


The first example assumes that flash device AMD 29F040 (512x8) 4 devices is 
selected using the TF DEVICE command, and uses the TF CONF syntax. Select 
Oxff002000 for the RAM workspace. The base address of the flash should be 
Oxffc00000. 


>BKM>tf£ conf 
- BDM TFlash programming Interface Settings - 


Current device selected : AMD 29F040 ( 512 x 8) 4 Devices 
Start of work space in target : 00000000 > OFFO0200 

Start address of the flash : FFFFFFFF > FFCO0000 

>BKM> 


The second example uses the TF CONF device_number RAM_workspace_address 
workspace_size base_address syntax. The device number for the AMD 29F030 (512x8) 
4 devices is 12, the RAM workspace address is 0xFF002000, the workspace size is 
1968 bytes, and the flash base address is 0xFFD00000. 

>BKM>TF CONF 12 FF002000 1968 FFD00000 


12 FFO02000 1912 FFD00000 
>BKM> 


See also the TF DEVICE command and the TF CONF SIZE command. 


Target Flash Configure - Size (TF CONF SIZE) 


Use the TF CONF SIZE command to specify the RAM workspace size. This is the 
size (in hex) required for the erase and program algorithm in RAM. 


Syntax 


TF CONF SIZE size_in_hex 


Example 


>BKM>TF CONF SIZE OxFFFFFFFF 
>BKM> 
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3 Low-Level Commands 
3.1 Low-Level Commands 


Use the TF DEVICE command to select the particular flash device for erasing and 
programming that is included on your target. 


Syntax 


TF DEVICE 


When you enter this command, Workbench displays a list of all available flash 
devices, each with a corresponding device number. You can find your device on 
the list and enter the device number that appears beside it. 


Example 

Display the device list. 
>BKM>t£ device 

00: AMD 29LVO04T ( 
01: AMD 29LVO04B ( 
02: AMD 29LVO04B ( 
03: AMD 29LVO04B ( 
04: AMD 29LVOO08BT ( 
05: AMD 29LV008BB ( 
06: AMD 29F010 = ( 
07: AMD 29F010 = ( 
08: AMD 29F010 = ( 
09: AMD 29F010 = ( 
10: AMD 29F040 = ( 
11: AMD 29F040 = ( 
12: AMD 29F040 = ( 
13: AMD 29F040—( 
14: AMD 29F080/81( 
15: AMD 29F080/81 ( 
16: AMD 29F080/81 ( 
17: AMD 29F080/81( 
18: AMD 29F016/17( 
19: AMD 29F016/17( 
20: AMD 29F016/17 ( 
21: AMD 29F016/17 ( 
-> More <- 


512 
512 
512 
512 
1024 
1024 
128 
128 
128 
128 
512 
512 
512 
512 
1024 
1024 
1024 
1024 
2048 
2048 
2048 
2048 


Pe | 


WDDADDADDAWDAADADAADADADAADAOAA WOW CO WO CO © 


of cow 


ow 


ow 


Devices 
Device 

Devices 
Devices 
Device 

Devices 
Device 

Devices 
Devices 
Devices 
Device 

Devices 
Devices 
Devices 
Device 

Devices 
Devices 
Devices 
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294: SST 39xF160 (1024 x 16 ) 2 Devices 
295: STM M58BWO16BB( 512 x 32 ) 1 Device 
296: STM M58BWO16BT( 512 x 32 ) 1 Device 
297: FrSc 5554H7Fv135( 256 x 64 ) 1 Device 
298: Toshiba 58FVB641( 8192 x 8) 1 Device 
299: Toshiba 58FVT641( 8192 x 8) 1 Device 
300: Toshiba 58FVT641( 4096 x 16 ) 1 Device 
301: Toshiba 58FVT641( 4096 x 16 ) 2 Devices 


New Choice > 


At the New Choice > prompt, enter the number of your selection and press ENTER. 
This specifies your flash device. 


Target Flash Erase (TF ERASE) 


Syntax 


Use the TF ERASE command to erase a flash device. Prior to using the TF ERASE 
command, configure the emulator properly for flash programming using the 

TF DEVICE, TF CONF, and TF TIMEOUT commands. The erase algorithm is 
downloaded into RAM workspace (which is specified using the TF CONF 
command) on the target. 


TF ERASE optional_addr1 optional_addr2 


optional_addr1 — This is the first address to erase (it must be a sector boundary) 
optional_addr2 — This is the last address to erase (it must be a sector boundary) 


If no optional addresses are given, the entire flash device is erased. 


Examples 


Erase the entire flash device, which was configured previously using the TF CONF 
and TF DEVICE commands. 


BKM>tf£ erase 


AMD 29F016 ( 2048 x 8 ) 2 Devices 
Erasing Flash(s)...Done 
BKM> 


Erase the flash devices from sector boundary address 0xFFC00000 to 0xFFD00000 


BKM>tf£ erase ff£c00000 ££d00000 


AMD 29F016 ( 2048 x 8 ) 2 Devices 
Erasing Flash(s)...Done 
BKM> 


See also the TF CONE, TF DEVICE, and TF TIMEOUT commands. 
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Target Flash Test (TF TEST) 


Syntax 


Use the TF TEST command to test erasing and programming target flash. The 
benefit of TF TEST is that a file is not required to program flash. Instead, the 
emulator directly programs a 0x2ff Byte test pattern into the target flash. The 

TF TEST command downloads the erase and program algorithms into RAM 
workspace (as determined by the TF CONF command). After downloading these 
algorithms, execute the erase/program algorithms with the GO command. The 
processor executes a software breakpoint when the algorithm completes. 


The test pattern is *WRS_FLASH*_ (ASCII format) repeated for Ox2ff bytes. 


TF TEST 
GO addr 


addr — This is the start address of the erase and/or program algorithm. 


Example 


Test erasing and programming target flash: 


BKM>tf£ test 


The flash algorithm : AMD 29F080/81 ( 1024 x 8 ) 4Devices 

has been loaded. The remaining Workspace is filled with a pattern 

Flash to be programmed starts at = $E0000000 
End of current flash device selected at = SEO3FFFFF 
End of the workspace is at = $00000EA0 
Programming algorithm starts at (PC set to this address) = $0000002C 
Erase algorithm starts at = $0000001C 
Work space starts at = $00000000 
Work space ends at = $00000EA0 
Test pattern starts at = $000004A0 
BKM>go 0000001ic 

RUN> 

!'HALT! - [msg90004] Unexpected software breakpoint encountered; PC=00000298 


BKM>dm e0000000 
E0000000: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ....... 0. cece cece cece eens 


BKM>tf£ test 
The flash algorithm : AMD 29F080/81 ( 1024 x 8 ) 4Devices 
has been loaded. The remaining Workspace is filled with a pattern 


Flash to be programmed starts at = $E0000000 
End of current flash device selected at = SEO3FFFFF 
End of the workspace is at = $00000EA0 
Programming algorithm starts at (PC set to this address) = $0000002C 
Erase algorithm starts at = $0000001C 
Work space starts at = $00000000 
Work space ends at = S$00000EA0 
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Test pattern starts at = $000004A0 
BKM>go 0000002c 

RUN> 

!'HALT! - [msg90004] Unexpected software breakpoint encountered; PC=0xFF0023DC 
BKM>dm e0000000 

E0000000: 2A45 5354 5F46 4C41 5348 2A5F 2A45 5354 *WRS_FLASH*_*WRS 
BKM> 

E0000010: 5F46 4C41 5348 2A5F 2A45 5354 5F46 4C41 _FLASH*_*WRS_FLA 
BKM> 

E£0000020: 5348 2A5F 2A45 5354 5F46 4C41 5348 2A5F SH*_*WRS_FLASH*_ 
BKM> 

E0000030: 2A45 5354 5F46 4C41 5348 2A5F 2A45 5354 *WRS_FLASH*_*WRS 
BKM> 

E0000040: 5F46 4C41 5348 2A5F 2A45 5354 5F46 4C41 _FLASH*_*WRS_FLA 
BKM> 

E0000050: 5348 2A5F 2A45 5354 5F46 4C41 5348 2A5F SH*_*WRS_FLASH*_ 
BKM> 

E0000060: 2A45 5354 5F46 4C41 5348 2A5F 2A45 5354 *WRS_FLASH*_*WRS 


Target Flash Timeout (TF TIMEOUT) 


Syntax 


The TF TIMEOUT command determines the amount of time in seconds that 
Wind River Workbench waits when erasing flash. Larger flash devices require a 
longer timeout period. 


TF TIMEOUT optional_seconds 


optional_seconds — This is the time in seconds that Wind River Workbench waits 
when erasing flash. 


If no parameter is specified, this command shows you the present value for 
timeout. Timeout values for both erase timeout and program timeout are 
displayed. 


The TF TIMEOUT command only allows you to modify the erase timeout value. 
The erase timeout value can be any number of seconds between 1 and 500. The 
program timeout value can be any number of seconds between 1 and 8. To modify 
the program timeout value, use the following syntax: 


TF PROGTIMEOUT seconds 


Examples 


Set the erase timeout period to 30 seconds. 


>BKM>tf£ timeout 30 
>BKM> 
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Set the progtimeout period to 6 seconds. 


>BKM>t£ progtimeout 6 
>BKM> 


Check the present timeout periods. 


>BKM>t£ timeout 
erasetimeout is 30 seconds 
progtimeout is 6 seconds 
>BKM> 


Target Flash Upload Sector (TF UPLOAD SECTOR) 


Syntax 


This command provides a list of the starting addresses of all of the different sectors 
of your flash device based on the flash algorithm that you have specified. 


TF UPLOAD SECTOR 


Example 


>BKM>tf£ upload sector 
Sector 0 : 0x00000000 


Sector 1 : 0x00040000 
Sector 2 : 0x00080000 
Sector 3. : 0x000C0000 
Sector 4 : 0x00100000 
Sector 5 : 0x00140000 
Sector 6 : 0x00180000 
Sector 7 : 0x001C0000 
>BKM> 


3.1.69 Trigger On Breakpoint (TRG) 


Syntax 


(Wind River ICE SX only) 


This command allows you to set a trigger on a breakpoint. You can use the TRG 
command to set a trigger that will be executed when the CPU hits an internal 
hardware or software code breakpoint. 


[sB, IHBC] breakAddress > TRG 


SB sets the system to trigger on a software breakpoint. 


IHBC sets the system to trigger on an internal hardware breakpoint. 
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breakAddress = the breakpoint address. 


Example 


In the following example, a conditional software breakpoint is set at address 41244. 
After 100 executions of code at this address, the target will break, at which point 
the unit will set the trigger out signal based on the parameters set in the CF 
options. An internal hardware breakpoint is also set at 40578 and when this is hit, 
it will break and set trigger out in the same manner as above. 

BKM > SB 41244 100 > TRG 

BKM > IHBC 40578 > TRG 

BKM > DB 


Software Code Breakpoints 
ds, 00041233 count = 0100 actual = 0000 enabled Trigger is ENABLED 


Hardware Breakpoints 


2. HBC 00040578 BRK enabled (i0.0) Trigger is ENABLED 

BKM > GO 40400 

RUN > 

!BREAK! - [msg11001] Internal hardware breakpoint; PC = 0x00040578 
BKM > GO 

RUN > 

!BREAK! - [msg12000] Software breakpoint; PC = 0x00041244 

BKM > 


3.1.70 Trigger Pulse Out (TRGOUT) 


Syntax 


(Wind River ICE SX only) 


This command generates a pulse on the Out pin of the Trigger port on the 
Wind River ICE SX unit. It can be used to trigger devices such as oscilloscopes and 
logic analyzers. 


The pulse that is generated has a fixed width and an amplitude of 3.3 volts. The 
pulse can have either a positive or a negative amplitude, which is set using the 
CF TRGOUT command and setting it to either PULSEHI or PULSELO. PULSEHI 
triggers a pulse with a positive amplitude, and PULSELO triggers a pulse witha 
negative amplitude. 


TRGOUT 


See also the CF command. 
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4.1 Introduction 
The commands described in this chapter can be included ina script, which you can 
then run in Wind River Workbench using the following steps: 


1. Inthe Workbench toolbar, select Window > Show View > OCD Command 
Shell. 


2. Inthe OCD Command Shell, click the Settings button. 
The Settings dialog appears. 


3. Enter the full path to your script in the PlayBack File field, or click Browse to 
navigate to a desired script. 
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4. Click OK. 
You are returned to the OCD Command Shell. 

5. Inthe OCD Command Shell, click the Playback File button. 
Workbench runs the specified script. 


4.2 Initialization Commands 


4.2.1 LOADREG 


Syntax 
LOADREG filename 


Load register values from a saved register file to the emulator NVRAM. 


4.2.2 LOADSIMREG 


Same as LOADREG. 


4.2.3 SAVEEMULATORREG 


Syntax 
SAVEEMULATORREG filename 


Upload all register values from the emulator NVRAM to a specified file. This 
command saves values for all registers, from both enabled and disabled register 
groups. 

Bear in mind that the register values on the target may not be identical to the 
register values in the emulator NVRAM. To compare the register values on the 
target with the register values in the emulator NVRAM, use the command 

SCT DIFF. 
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4.2.4 SAVESIMREG 


Same as SAVEEMULATORREG. 


4.2.5 SCUPLOAD 


Same as SAVEEMULATORREG. 


4.2.6 SAVETARGETREG 


Syntax 
SAVETARGETREG filename 


Upload all register values from the target to a file. This command saves values for 


all registers, from both enabled and disabled register groups. 


Bear in mind that the register values on the target may not be identical to the 
register values in the emulator NVRAM. To compare the register values on the 
target with the register values in the emulator NVRAM, use the command 


SCT DIFF. 


4.2.7 SCTUPLOAD 


Same as SAVETARGETREG. 


4.2.8 SAVENVRAM 


Syntax 
SAVENVRAM filename 


Run a PJ UPLOAD command and save the output to the specified file. The 
PJ UPLOAD command returns the emulator’s current configuration settings and 
the state of register groups (enabled or disabled), as well as Memory Management 


Unit (MMU) and boot line (BL) information, if available. 


This command returns information only from the emulator NVRAM; it does not 


return information from the target. 
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4.2.9 RESTORENVRAM 


Syntax 
RESTORENVRAM filename 


Set the emulator’s configuration options and other project settings to the values 
from the specified file. Use this command to restore the emulator NVRAM to 
settings you have previously saved using the SAVENVRAM command. 


4.3 Download Commands 


4.3.1 LOAD 


Syntax 
LOAD filename offset 


Load the specified file to target memory. offset is a value in hex added to the 
address built into the image. 


4.3.2 DOWNLOAD 


Same as LOAD. 


4.3.3 DOWN 


Same as LOAD. 


4.3.4 LOADVERIFY 


Syntax 
LOADVERIFY filename offset 


Downloads a specified file to the target and verifies all memory writes to the target. 
offset is a value in hex added to the address built into the image. 
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4.3.5 LOADANDVERIFY 


Same as LOADVERIFY. 


4.3.6 VERIFYONLY 


Syntax 
VERIFYONLY filename offset 


Verifies the specified file against target memory. This command does not 
download the specified file. offset is a value in hex added to the address built into 
the image. 


4.3.7 VERIFY 


Same as VERIFYONLY. 


4.3.8 LOADMACRO 


Syntax 
LOADMACRO filename 


Loads all macros coded in the specified file. This command allows only one 
filename. 


4.3.9 LOADMACROS 


Syntax 
LOADMACROS filename_1, filename_2, ... 


Loads all macros coded in the specified files. This command allows multiple 
filenames. Separate filenames with a space, a comma, and another space. 
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4.3.10 FLASHIT 


Syntax 
FLASHIT filename offset 
Program the specified file to flash memory with the specified offset. 


4.3.11 UPLOADBIN 


Syntax 
UPLOADBIN filename start_addr end_addr [append] 


Upload a raw binary file to the specified filename over the range bounded by 
start_addr and end_addr. Use the argument append to upload the data without 
overwriting any previously existing data in the specified file. 


The command is a byte-oriented access request; that is, the order of bytes in the file 
is the same as the order of bytes in memory. 


4.3.12 SETBLOCK 


Syntax 
SETBLOCK number 
Set the size of the download. 


number is the number of kilobytes used on download. The default is 2. 


4.3.13 BLOCKSIZE 


Same as SETBLOCK. 


4.3.14 BLOCK 


Same as SETBLOCK. 
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4.4 Breakpoint Commands 


4.4.1 BREAKENABLE 


Enable all breakpoints. 


4.4.2 BREAKDISABLE 


Disable all breakpoints. 


4.4.3 BREAKDELETE 


Delete all breakpoints. 


4.4.4 BREAKIN 


Syntax 
BREAKIN symbol or address 


Set a breakpoint at the specified symbol or address. 


4.5 Complex Breakpoint Commands 
The nine commands in this section all use the same syntax, which take the 
following four arguments: specifier, action, data, and [firmware_command]. 
specifier - This can be any of the following: 
» — symbol_name 
« — function_name 
« — filename:line_number 


= address 
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(address) 


start_address . . end_address 


action - This can be any of the following: 


TE (Trace Enable) 

TD (Trace Disable) 

TC (Trace Around Here) 
BRK (Break Here) 

TRIG (Trigger Trace Here) 
EXTRIG 


data - This is a numeric value. Leading zeroes indicate the size of the data 
comparison. It can also take the format xx/xxxx/xxxxxXx/XXXXXXXX. 


[firmware_command] -- This syntax is allowed, but the functionality is not 
supported in Workbench. That is, using a firmware command as an argument here 
will not cause an error, but Workbench will not execute the command. 


NOTE: Implementation of these commands varies between processor families. 
Depending on which processor you are using, you may not have access to all types 
of internal hardware breakpoints. 


4.5.1 SETSB 


Syntax 


SETSB specifier action data 


Set a software breakpoint at the specified location. 


4.5.2 SETHBC 


Syntax 


SETHBC specifier action data 


Set a hardware code breakpoint at the specified location. 
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4.5.3 SETHBD 


Syntax 
SETHBD specifier action data 


Set a hardware data breakpoint at the specified location. 


4.5.4 SETHBDR 


Syntax 
SETHBDR specifier action data 


Set a hardware data breakpoint on any read to the specified location. 


4.5.5 SETHBDW 


Syntax 


SETHBDW specifier action data 


Set a hardware data breakpoint on any write to the specified location. 


4.5.6 SETIHBC 


Syntax 
SETIHBC specifier action data 


Set an internal hardware code breakpoint at the specified location. 


4.5.7 SETIHBD 


Syntax 
SETIHBD specifier action data 


Set an internal hardware data breakpoint at the specified location. 
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4.5.8 SETIHBDR 


Syntax 
SETIHBDR specifier action data 


Set an internal hardware data breakpoint on any read to the specified location. 


4.5.9 SETIHBDW 


Syntax 
SETIHBDR specifier action data 


Set an internal hardware data breakpoint on any write to the specified location. 


4.6 Run/Step Commands 


46.1 G 
Send a GO command to the emulator to start the target running. 
4.6.2 H 
Send a HALT command to the emulator to stop the target CPU and force the target 
into background mode. Also updates all open Workbench views. 
4.6.3 ISTEP 
Step one assembly-language instruction. 
Syntax 


ISTEP count 
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ISTEP will always step at least one instruction, so count is the number of steps 
beyond one you want to step. For example, the command ISTEP 5 will step six 
times. 


4.6.4 ISTEPOV 


Step over one assembly-language instruction. 


Syntax 
ISTEPOV count 


count is the number of times Workbench will step over. 


4.6.5 PLAY 
Play back commands from the required file. 


Syntax 


PLAY filename 


4.6.6 RUNTO 
Direct the emulator to step over branches. A temporary breakpoint is set at the next 
instruction and a GO command is issued. If a branch condition exists, all code in 


the branch will be executed before the breakpoint is taken. 


Syntax 
RUNTO symbol or address 


Example 


RUNTO main.c#65 


4.6.7 SETPC 


Set the Program Counter to a specified symbol or address. 
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SETPC symbol or address 


Step a source line into a function. 


STEP count 


count is the number of times Workbench will step. 


4.6.9 STEPOV 


Syntax 


Step a source line over a function. 


STEPOV count 


count is the number of times Workbench will step over. 


4.6.10 STEPOUT 


4.6.11 WAIT 


Syntax 


Step to the first line outside of the current function. 


Display an hourglass for the indicated number of seconds. Takes one argument, 
which is the number of seconds to wait before continuing; the limit is 10. 


WAIT number_of_seconds 


NOTE: For previous users of visionCLICK: in visionCLICK, the WAIT command 
could be set to any number of seconds. Workbench manages its backend 
differently, so the WAIT command is limited to ten seconds. 
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4.7 Memory Commands 


4.7.1 DUMPMEM 


Syntax 
DUMPMEM filename addr number_of_elements element_size 


Dump memory at specified address addr to a specified file. 


4.7.2 APPENDMEM 


Syntax 
APPENDMEM filename addr number_of_elements element_size 


Append memory at specified address addr to a specified file, without overwriting 
any data that already exists in that file. 
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5.1 Wind River ICE SX Network Command Reference 


NOTE: This chapter applies only to the Wind River ICE SX emulator. 


5.1.1 APPLOAD 


Wind River ICE SX supports dynamic firmware uploads. The APPLOAD 

command can be used to dynamically activate any set of firmware that is stored in 

the Wind River ICE SX unit. The APPLOAD command returns a port number. 
Syntax 

APPLOAD processor:designator:Filename 


processor = This is the processor that is resident on your target, such as MPC8260. 


designator = This is the reference designator that is assigned to the device that you 
are loading the firmware for. It is the designator that identifies that device in the 
JTAG scan chain, and it is the parameter that you specify in your board file. 


Filename = This is the name of the board file to be loaded. 


designator and Filename are optional in this command. If there is only a single 
device on the JTAG scan chain, you only need to specify a processor. 
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Example 


The following example describes loading a file called Motorola_2_PPC8260.brd 
for a MPC8260 processor, with reference designator U0. Then the DISPLAY 
command is used to display the active firmware. 


>NET>appload MPC8260:U0:Motorola_2_PPC8260.brd 


Loading Application from FFS... 


KKK KKK KKK KKK KKK KKK KK KKK KK KK KKK KKK KK KK KKK KK KK KKK KKK KK KKK KKK RK KK KKK KKK KK KKK KKK 


Wind River ICE Target Driver 
Copyright (c) 2004, Wind River Systems, Inc. All rights reserved 


KR KKK KKK KKK KR KKK KKK KKK KKK KK KKK KKK KR KKK KKK KK KK KKK KKK KK KKK KKK KKK KKK KKK KKK KKK KKK 


Firmware Type PPC82XX Version 1.0q Created On: Jul 23 2002 17:45:20 


Starting TCP BKM tools server ESTDO [ 1234] ........ PASSE 

Starting TCP BKM tools server TCPDO [ 1235] ........ PASSED 
Starting TCP BKM tools server LOADDO [ 1236] ........ PASSED 
Starting TCP TGTVIO server TVIODO [ 1237] ........ PASSED 
Starting with Saved ParametersS.......... cc eee eee eee PASSED 


KR KKK KKK KKK KKK KK KKK KKK KKK KK KKK KKK KK KK KKK KK KK KKK KKK KK KKK KKK KKK KKK KKK KKK KKK KKK 


WIND River ICE UJD module 
Copyright (c) 2002, Wind River Systems, Inc. All rights reserved 

KKK KKK KKK KEK KK KKK KKK KKK KEK KKK KKK KKK KEK KEK KEK KKK KKK KKK KKK KKK KKK KK KEK KKK KKK KKEKKKKEKKKK 
Firmware Type UJD Module Version 1.0m Created On: Jul 23 2002 14:47:02 
Initializing the UJD module............ 0. cece eee 
Attaching to the UID. Module waa cei ees he we ele ONS 


!PORT! - [ 1234] Attached to the Application Task.... 
>NET>display 

module_name:parms port 
ppc82xx.elf:U0:Motorola_2_PPC8260.brd 1234 
servers.elf N/A 

>NET> 


See the DISPLAY command for more information. 


5.1.2 ARP 
Syntax 
arp [-a] [-d] [-s] [host] 
Synopsis 
Performs operations on the network ARP table 
Description: 


The ARP command allows for various operations on the network Address 
Resolution Protocol table (ARP table). The ARP table translates IP addresses into 
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Ethernet addresses and vice versa. The simplest form of the ARP command is ARP 
host where host is the IP address of another node. The command will display the 
associated Ethernet address for host if it is in the ARP table. The command ARP -a 
displays the entire contents of the ARP table. 


It is possible to remove a host from the ARP table with the command ARP -d host 
where host is the IP address of the node you wish to delete. This is sometimes 
useful for testing or if a host changes its Ethernet address. 


Hosts can be manually added to the ARP table with the command ARP -s host 
ether_addr. In this case, host is the IP address you wish to associate with ether_adadr. 


ether_addr is a 6 byte number delimited with colon characters (for example, 
00:0A:00:99:01:ff). 


BKM [-n] 


Synopsis 


Opens a channel to the >BKM> board prompt 


Description 


The BKM command allows users to open a channel to the BDM board and interact 
with the target via the BKM commands. Upon entering BKM Mode, the >NET> 
prompt will disappear and be replaced by a >BKM> prompt. All commands and 
responses will be from the BDM card in the Wind River ICE SX. To exit from the 
>BKM> prompt, type CTRL+D. This will return a >NET> prompt. The -n option 
suppresses sending an initial new line character. This is useful in some instances 
since a new line will restart an old BKM command. 


Before a BKM command will pass, you need to perform an APPLOAD. See the 
APPLOAD command. 


Example: 


NET> bkm 


Entering BKM Mode. 
Opening channel ... Complete. *“D to exit BKM mode. 


>BKM> 
>BKM> in 
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KR KKK KKK KKK KKK KK KKK KKK KKK KK KKK KKK KK KK KKK KKK KKK KK KKK KKK KKK KK KKK KKK KKK KEKK 


Wind River ICE Initialization Sequence. 
Copyright (c) Wind River Systems, Inc., 1999-2004. All rights reserved. 


KR KKK KK KK KKK RK KK KKK KKK KKK KK KKK KKK KKK KK KKK KKK KKK KKK KK KKK KKK KKK KKK KKK KKEKK 


WIND River ICE UNIT#= none 


Support Expires....... 01/01/1995 
Warranty Number....... demo 
Target Processor...... 68341 
Serial Baud Rate...... 38400 
Host Debugger......... PSOS 
VisionControl Serial#= none Firmware=c2.8a / 6.0x 
Type CF For A Menu of Configuration Options 
Initializing Background Debug Mode........ Successful 
>BKM> “*D 
NET> 
5.1.4 BOOTLOG 
Syntax 
BOOTLOG 
Description 
The BOOTLOG command displays the tests that were run during the last 
Wind River ICE SX reset. The information that is displayed includes information 
about the network configuration for Wind River ICE SX, as well as all of the 
hardware and firmware tests that were run and whether or not they passed. 
Example 


The following is the display that appears when the BOOTLOG command is entered 
at the >NET> prompt. 


KR KKK KKK KKK KR KKK KKK KKK KKK KK KKK KKK KK KK KKK KK KK KKK KKK KKK KK KKK KKK KKK KKK KK KKK KKK 


Wind River ICE SX Ethernet Platform 
Copyright (c) 2004, Wind River Systems, Inc. All Rights Reserved 


KR KKK KK KK KKK KKK KR KKK KKK KKK KK KKK KKK KK KK KKK KK KK KKK KKK KKK KK KKK KKK KKK KK KKK KKK KKK 


Firmware Type Wind River ICE SX BSP Version 1.2f Created On: Jun 10 2004 


14:06:39 
Configuring TCP/IP Network Suite: 
IP Address...... DHCP 


DHCP Sending DISCOVER 0 - 1 - + 

DHCP OFFER received 

DHCP Sending REQUEST 0 - 1 - + 

DHCP ACK received 
DHCP Server at 172.16.12.114 returned IP address 172.16.17.35 
DHCP IP address 172.16.17.35 lease time - 7 days, 0 hours, 0 min 


Netmask......... DHCP = OxFFFF0000 
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Default Gateway DHCP = 172.16.1.1 


ROUEUNG aa 5 hw Disabled 

MAC Address..... 00:A0:1E:00:32:E7 

Pseudo device initialization................. PASSED 
TFTP device initialized....................2.. PASSED 
Wind River ICE SX device initialized............ PASSED 
Starting TCP/IP on Port A 10BaseT............ PASSED 
Starting TCP/IP on Port B 100BaseT........... PASSED 
Starting DHCP daemon server................4. PASSED 
Initializing PES Drivers iso. oet¢xawe aateeew eee PASSED 
FFS disk initialized 2640 Kbytes free........ PASSED 
FFS disk 0 percent fragmented................ PASSED 
Disk volume 45.0.0 initialization............ PASSED 
Starting TCP TGTCONS server TGTCONS [ 1232]..PASSED 


Starting WRS shell server 
Wind River ICE SX System Shell - Type HELP for list of commands 


>NET> 
5.1.5 CAT 

Syntax 
caT filename 
filename = This is the name of the file in Wind River ICE SX that you wish to 
display. 

Description 
The CAT command displays the contents of a file in the Wind River ICE SX Flash 
File System in ASCII format. 

Example 


The following example uses the CAT command to display the contents of the 
8260_2.xml file in ASCII format. 


>NET>cat 8260_2.xml1 
<DEVICE_TABLE> 
<TABLE_MODE>SLOW</TABLE_MODE> 
<TABLE_CLOCK>6MHZ</TABLE_CLOCK> 
<!--Enable Multiple devices on a chain--> 
<TABLE_MULTI>ENABLE</TABLE_MULTI> 
<DEVICE> 
<NAME>8260_1</NAME> 
<DESCRIPTION>8260 Processor</DESCRIPTION> 
<TYPE>MICROPROCESSOR</TYPE> 
<TARGET>8260</TARGET> 
<DESIGNATOR>U0</DESIGNATOR> 
<IR_LEN>8</IR_LEN> 
</DEVICE> 
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<DEVICE> 
<NAME>8260_2</NAME> 
<DESCRIPTION>8260 Processor</DESCRIPTION> 
<TYPE>MICROPROCESSOR</TYPE> 
<TARGET>8260</TARGET> 
<DESIGNATOR>U1< /DESIGNATOR> 
<IR_LEN>8</IR_LEN> 
</DEVICE> 
</DEVICE_TABLE 
>NET> 


5.1.6 COMTAP 


NOTE: You must make a connection with your software before executing a 
COMTAP session. 


Syntax 
comTaP process_name [-o | -i] [-b] 
where process_name is the name of the server to tap (for example, bkm or tcpd) 
[-o | -i] will trace only output or only input (both by default) 
[-b] will monitor binary protocols (ASCII by default) 


Synopsis 
Traces host/ Wind River ICE SX interactions. 


Description: 


COMTAP is a flexible tool for tracing host/Wind River ICE SX interactions. 


Examples: 
NET>comtap bkm -o /* Will echo BKM data to a telnet session */ 
NET>comtap bkm -o -b /* Will display dump of BKM data to telnet session*/ 
NET>comtap udpd /* Will monitor all UDP debugger transactions */ 
NET>comtap loadd -o /* Will monitot all LOADER ASCII data net->host */ 
Exceptions: 


« Monitoring tcpd or udpd is always done in Binary Mode. 


« Loading .BDX files will only display initial ASCII sequence unless the -b 
switch is specified. 
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Since all data is echoed in BDM Mode, the -o switch should be used unless you 
are interested in double echo of input. 


BKM is a legal process name (even if it does not show up in a pstat) as long as 
a BKM session is active. 


COMTAP can only be used from Telnet sessions. It will simply return on the RS232 

console. To exit Comtap Mode, press the ENTER key in the Telnet session 
displaying the monitored data. Note that there may be some data queued up, so it 

may take a moment before output stops. 


To 


see a list of running processes that are available fora COMTAP session, type the 


command PSTAT at the >NET> prompt. 


5.1.7 DATE 


Syntax 


pate [yyyymmddhhmml.ss]] 


Synopsis 


Displays and/or sets the current system calendar date and time of day. 


Description 


Th 


e Wind River ICE SX system maintains a calendar date and time while it is 


running. This is used primarily for system log purposes to time correlate data. 
Entering the date command with no arguments yields the current system date and 
time of day. At system startup, the date is set to January 1, 1990 at midnight. 


You may change the system date, although it is not necessary to do so unless you 
wish to use the system date/day to time the duration of tests, etc. 


Example: 


NET 
0: 
NET 


[> date 


15:20 Jan 1 1990 


[> date 199403050900.00 


9:0:0 Mar 5 1994 


NET 


[> date 


9:0:1 Mar 5 1994 


NET 


> 
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5.1.8 DEFRAG 


Syntax 


DEFRAG 


Description 


The DEFRAG command optimizes space in the Flash File System on 

Wind River ICE SX, freeing up blocks of space that are not being used to their full 
potential. Defragmenting the Flash File System on Wind River ICE SX is similar to 
defragmenting a hard drive on your PC. 


Example 


The following example illustrates the output that appears when the DEFRAG 
command is being used. 


>NET>defrag 
Defragmenting the FFS will free up invalid blocks 
!DO NOT reset or power-cycle the ICE during this operation 


>NET> 
5.1.9 DIR 
Syntax 
DIR 
Description 
The DIR command displays all of the files that are currently stored in 
Wind River ICE SX. 
Example 
>NET>dir 
Volume in FFS is 45.0.0 
2048 BITMAP.SYS 
14336 FLIST.SYS 
1850316 81v3rl6p.bin 
18575 vp_dll.cfg 
108681 cachsp2k.elf 


2 


2 


11408 
21 


1408 


16561 


1668785 


453 


343860 
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flxppc6xx.hex 
servers.elf 
msc81xx.elf 
Motorola_8101ADS.brd 
MSC81XX_U17.dat 
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347 BD_WRS8260.brd 
7104 tdfppc.bin 
126497 cache6xx.elf 
303720 ppcjtflh.bin 
304984 ppcjtflhr.bin 
2544929 ppc82xx.elf 
343860 MPC82XX_U1.dat 
347 BD_WRS82xx.brd 
854560 flashbsp.bin 
628 8260_2.xml 
343860 MPC82XxX_U0.dat 
22 file(s) 9477267 bytes 
0 dir(s) 17564525 bytes free 
>NET> 


5.1.10 DISPLAY 


Syntax 
display 
Description 


The DISPLAY command displays information about the application firmware that 
you have running on your Wind River ICE SX unit. Entering the DISPLAY 
command without any parameters will list all of the application firmware that is 
currently running on your Wind River ICE SX unit. 


Example 


This example uses the DISPLAY command with no parameters specified. 


>NET>display 

module_name:parms port 
ppc82xx.elf:U0:8260_2.xml 1234 
servers.elf N/A 
>NET> 


5.1.11 ETHSETUP 


Syntax 


ETHSETUP 


Synopsis 


Modifies the Ethernet non-volatile setup parameters. 
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Description 


The ETHSETUP command allows users to modify the non-volatile copy of the 
Ethernet setup parameters. Unlike the Configuration Switch method, ETHSETUP 
allows users to return to the >NET> prompt. Any new parameters will take effect 
after the next hardware reset (reset performed by tripping the switch on the rear of 
the emulator) or RESET command. 


Example 


>NET>ethsetup 


Ethernet Setup Mode 

Select from the operations below 
1. Display Basic IP parameters 2. Modify Basic IP parameters 
3. Display Routing parameters 4. Modify Routing parameters 
5. Display Server parameters 6. Modify Server parameters 
7. View ethernet address 8. Save parameters 
9. Exit setup mode 10. Port A/B select 
11. Advanced Options 

Make a selection: 


5.1.12 HELP 


Syntax 

HELP topic 
Synopsis 

Displays general or topic-specific online help 
Description 


The HELP command displays help for a given topic (when a topic is specified) or 
general help concerning available commands when entered with no arguments. 


Example: 
>NET>help 
appload arp bkm bootlog brd cat cd 
coldstart comtap date defrag dir display download 
du echo ethsetup firmup help ifconfig load 
netinfo netstat ping pstat query reset route 
runtime sync syslog unload version ftp telnet 
tftp tget tput update 
>NET>help appload 
Command Description Syntax 
appload Load an application with APPLOAD </t/s(hostip or hostname) > 
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CPU translation <target name> 
>NET> 
5.1.13 IFCONFIG 
Syntax 
| 
IFCONFIG interface_number 


netmask mask |[ broadcast broad_addr | | 
arp | -arp | 
ifconfig -a 


| af | address Pcie ]][ up ][ down ] 


Synopsis 


Reconfigures a network interface. 


Description 


The IFCONFIG command allows viewing and modifying of the network interfaces 
in Wind River ICE SX. There are two interfaces available: The Ethernet interface 
and Loopback interface. The Loopback interface should never need modification. 


When combined with just the -a switch, the IFCONFIG command will display the 
state of the network interfaces, as shown below: 


>NET>ifconfig -a 

1: flags=120201<BROADCAST, UP> 

inet 172.16.17.35 netmask ffff£0000 broadcast 172.16.255.255 
6: flags=212<NOARP,UP> 

inet 127.0.0.1 netmask f££000000 

>NET> 


When used in combination with other flags, the IFCONFIG command allows users 
to temporarily change the network interface settings. The new settings will be lost 
on power-off or reset unless they are programmed using the ETHSETUP command. 
The example below shows how to change Wind River ICE SX's IP address: 


NET> ifconfig 3 192.9.201.10 up 
NET> ifconfig -a 
1: flags=120201<BROADCAST, UP> 
inet 192.9.200.103 netmask ffffff00 broadcast 192.9.200.255 
3: flags=202<NOARP,UP> 
inet 192.9.201.10 netmask ffffff00 
NET> 
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5.1.14 NETINFO 


Syntax 


NETINFO 


Description 


The NETINFO command returns information about the Wind River ICE SX 
network configuration, including the IP address, netmask, and broadcast address. 


Example 


>NET>netinfo 

TCP/IP on PORT B 

1: flags=120201<BROADCAST, UP> 

inet 123.45.67.89 netmask ffff0000 broadcast 123.45.255.255 
>NET> 


This example shows the output of a NETINFO command. It returns the protocol the 
ICE is using (TCP/IP); the port in use (B); the number of broadcast flags in use, and 
whether they are up or down (flags); the IP address of the ICE unit (123.45.67.89); 
the ICE’s netmask (FFFF0000); and the ICE’s broadcast address (123.45.255.255). 


5.1.15 NETSTAT 


Syntax 
netstat [-a, -i, -r, -s] 
-a - Displays status of all network connections 
-i - Displays status of network interfaces 
-r - Displays network routing table 


-s - Displays per protocol information 


Description 


The NETSTAT command displays information about the TCP/IP protocol stack in 
Wind River ICE SX. It operates in a fashion similar to the NETSTAT command ina 
UNIX environment. The example below shows the output from various forms of 
the NETSTAT command. 

Example 


>NET>netstat 
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Proto 


tcp 


>NET>netstat 
Proto 


udp 
udp 
udp 
udp 
udp 
udp 
udp 
tcp 
tcp 
tcp 
tcp 
tcp 
tcp 
tcp 
tcp 
tcp 
tcp 
>NET 
I/F 
, 
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172 16217 
-a 
Local 


5 
j=) 


oo 


OO 3S. OO Oa OS, 
OOo OO O:.0 S:O OO OO OD Oo: 
font 


oon oo 00 0:0 0'0 00000 


OO OOO BO Seo Se eo |e: oS 


20%:0), 021 
[>netstat -i 
Mtu Address 
1500 172.16.17 
1536 127.0.0.1 


>NET 


[>netstat -r 


Destination 
default 


127. 
172. 
>NET>netstat 


0.0.1 
16.0.0 
-s 


udp: 


Local Address 


35.1234 


Address 


20 


.1234 
235 
Ipkts 


32232 
151 


239 


Gateway 
17232651 
LA ee Oa 
172.16.17.35 


Foreign Address 
172.16.18.142.1 


Foreign Address 


SOS Oo oc 


a 
ot Ger as 
oO ©:0O:-0 0 06: 0:'0O'O 


OONOTDCAOOCVOCCO 


142.1 


OOP Ooo 2. oOo-o 5 
OOrFOCOGCOCOGOCCCO 


2 o:+ 


0 199 
0 151 


Flags 
UG 

U 

U 


11123 datagrams delivered to users 
0 datagrams received for unknown ports 
281 datagrams received with other errors 


997 datagrams s 


tcp: 


ih er 


1104 segments s 


| TCP connectio 


13581 received 
0 drops due to 
1038 drops due 
0 drops due to 
0 discarded wit 


ent 


ent 


0 segments retransmitted 
0 segments sent with RST flag 
1139 segments received 

0 segments received in error 
0 failed TCP connection attempts 


ns reset 


from interfaces 


format errors 


to invalid addresses 


unknown protocol 


h no problems 


2101 supplied by IP user protocols 


0 dropped due t 
0 IP datagrams 


>NET> 


o no routes 
forwarded 


Opkts 


(state) 
957 ESTABLISHED 


(state) 


LIST! 
LIST! 
LIST! 
LIST! 
LIST! 
LIST! 
LIST! 
ESTABLISHED 
LISTEN 

LISTEN 


HHA Ae 
42442442444 


GI 


957 


Oerrs 
3 0 
0 0 


Interface 
1 
6 
‘ds 
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pine [-s] host_ip [repeat_count] 


Synopsis 


Sends ICMP ECHO_REQUEST messages to the specified host_ip. 


Description 


5.1.17 PSTAT 


Syntax 


The PING command provides a method to test that a connection can be established 
over the network to a specific host. It is very useful in diagnosing the ability to send 
packets to and from a host from the Wind River ICE SX unit. 


By specifying the -s switch, the PING command will repeat the operation 10 times 
or repeat_count times. When reporting results, the PING command will print the 
elapsed time to send/receive for each ICMP ECHO_REQUEST / ECHO_REPLY pair. 
The time is rounded to the nearest millisecond. 


PSTAT 


Synopsis 


Lists the state of processes on the Wind River ICE SX. 


Description 


Table 5-1 


The Wind River ICE SX is a multi-tasking system capable of executing many 
processes at once. The PSTAT command allows users to view the state of most of 
the system processes. This is useful when trying to determine what host process is 
associated with a server on the Wind River ICE SX. 


There are several types of processes that run on the Wind River ICE SX. They are 
outlined in the following table: 


Wind River ICE Processes 


Type Description 


PrmPro Permanent Process-Cannot be killed by the user 
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Table 5-1 Wind River ICE Processes 


Type Description 
PrmServ Permanent Server -- Can be killed and restarted by 
the user 
DynServ Dynamic Server -- Can be killed by the user; will 
restart as needed 
Example: 
>NET>pstat 
NAME TSK_ID TYPE PRIORITY STATE 
dhcp 00000017 DynProc 00000025 ConnWait 0.0.0.0 (0) 
TGTCONS *00000026 PrmServ 00000190 ConnWait 0.0.0.0 (1232) 
SHELLD *00000027 PrmProc 00000065 ConnWait 0.0.0.0 (1233) 
PPC82XX 00000045 00000180 running 
ESTDO *00000047 PrmServ 00000200 Connected 172.16.18.142 (1957) 
TCPDO *00000048 PrmServ 00000200 ConnWait 0.0.0.0 (1235) 
LOADDO *00000049 PrmServ 00000210 ConnWait 0.0.0.0 (1236) 
TVIODO *00000050 PrmServ 00000190 ConnWait 0.0.0.0 (1237) 
UID 00000066 PrmServ 00000210 running 
* = Tapable with comtap 
>NET> 
5.1.18 QUERY 
Syntax 
QUERY 
Description 


The QUERY command displays a list of all of the firmware versions that are 
currently stored in the Wind River ICE SX Flash File System. The display is a table 
that includes the file names, the type of file, the version of the firmware, and the 
date and time that it was added to Wind River ICE SX. 


Example 
>NET>query 
FFSNAME NAME TYPE VER DATE/TIME 
cache82xx.elf CACHE82XX CACHE APP 2.1a Oct 22 2004 16:08:16 
servers.elf UJD Module SERVER 2.3a Oct 21 2004 13:50:34 
cache6xx.elf CACHE 6XX CACHE APP 2.1a Oct 21 2004 13:51:16 
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ppc82xx.elf 
ppcéx.elf 


>NET> 


RESET 


Syntax 


RESET 


Synopsis 


PPC82XX TARGET APP 
PPCO6XX TARGET APP 


NO 
iS 
o 


Oct 22 2004 16:08:41 
Oct 21 2004 13:51:53 


iN} 
WwW 
o 


Issues a cold start reset of the emulator. 


Description 


The RESET command power cycles the Wind River ICE SX unit. This command is 
provided as a convenience and is typically issued after using the ETHSETUP 
command to modify the basic operating parameters of the Wind River ICE SX unit. 


ROUTE 


Syntax 


ROUTE [ADD,DELETE] [hostip | netip] destination [gateway [metric] 


Synopsis 


Adds or deletes network routes on the Wind River ICE SX. 


Description 


The ROUTE command allows users to temporarily add and delete network routes 
on Wind River ICE SX. To permanently add/delete routes, use ETHSETUP or 
consult your software documentation if dynamic routing is enabled. The ROUTE 
command is provided primarily for the purpose of testing routing entries or 
adding temporary routes. 


Example: 


NET> netstat 
Destination 
127.0.0.1 
192.9.200.0 


-r 


Gateway Flags Interface 
L227 00.051 U | 
192.9.200.103 U 1 


NET> route add 192.9.201.0 192.9.200.100 1 
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assuming route via gateway 

add net 192.9.201.0: gateway 192.9.200.100 (192.9.200.100) 
NET> route add 192.9.202.0 192.9.200.101 1 

assuming route via gateway 

add net 192.9.202.0: gateway 192.9.200.101 (192.9.200.101) 
NET> route delete 192.9.202.0 192.9.200.101 

delete net 192.9.202.0: gateway 192.9.200.101 (192.9.200.101) 
NET> netstat -r 


Destination Gateway Flags Interface 
127.0.0.1 127 50:40:21 U 3 
192.9.200.0 192.9.200.103 U ib 
192.9.201.0 192.9.200.100 UG 1 

NET> 


5.1.21 RUNTIME 


Syntax 


RUNTIME 


Description 
The RUNTIME command displays the length of time in days, hours, minutes, and 
seconds since the last Wind River ICE SX initialization. 
Example 
>NET>runtime 
Time since last reset/power cycle 


730 Days, 9 Hours, 27 Minutes, 3 Seconds 
>NET> 


5.1.22 SYSLOG 


Syntax 

SYSLOG 
Synopsis 

Displays a log of the last 25 events on the Wind River ICE SX unit. 
Description 


Wind River ICE SX maintains a log of the last 25 significant events that have 
occurred since the last time it was reset. These events are stored in a FIFO that can 
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be displayed by using the SYSLOG command. The SYSLOG command is useful for 
looking at the usage of particular facilities on Wind River ICE SX. 


In addition to usage information, any abnormal conditions are also saved in the 
system log. For example, if a server loses synchronization with a client and restarts 
itself, a message will be placed in the system log. 


System log information is shown with the most recent event first, followed by 
older events. The time stamps are relative to system start time or the last time/date 
set command. The format of the time is dd:hh:mmi:ss. 


Example: 
>NET>syslog 
[00:00:00:06] LOADAPPS : bootapps.1lst not found in FFS 
[00:00:00:06] TGTCONS : Server awaiting connection. 
[00:00:00:06] TGTCONS : Starting TCP TGTCONS server TGTCONS [ 1232] 
[00:00:00:06] FFS : Task Started 
[00:00:00:00] DHCP : Rebinding Time - 6 days, 3 hours, 0 min 
[00:00:00:00] DHCP : Renewal Time - 3 days, 12 hours, 0 min 
[00:00:00:00] DHCP : BOUND state 
[00:00:00:00] DHCP : daemon started 
>NET> 


5.1.23 TELNET 


Syntax 


TELNET [P_Address 


Synopsis 


Allows connection to other telnet capable hosts from the RS232 console. 


Description 


The TELNET command allows users to telnet from the RS232 console on 

Wind River ICE SX to any other host on the network that Wind River ICE SX can 
talk to. The telnet client in Wind River ICE SX is a close implementation of the BSD 
telnet command found in most UNIX systems. 


5.1.24 UNLOAD 


Syntax 


UNLOAD port_number Or NameOfProcess 
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port_number = This is the port number that was assigned to your activated 
firmware during the APPLOAD command. You can view the port number using 
the DISPLAY command. 


NameOfProcess = You can specify the name of the application firmware that you 
wish to deactivate instead of its associated port number. View the name of the 
application using the DISPLAY command. 


Instead of specifying a port number or a process name, using the command 
UNLOAD * will unload all active firmware sets. 


Description 


Wind River ICE SX supports dynamic firmware uploads and downloads. The 
UNLOAD command can be used to dynamically deactivate any set of firmware 
that is currently active on the Wind River ICE SX unit. Currently active processes 
can be viewed using the DISPLAY command. 


Example 


The first example uses the display command to view the active sets of firmware. 
Then a set of firmware is deleted using the UNLOAD command. 


>NET>display 

module_name:parms port 
ppc82xx.elf:U0:Motorola_2_PPC8260.brd 1234 
servers.elf N/A 


>NET>unload /1234 


Requesting 'ppc82xx' to delete Itself................ PASSED 
>NET> 


The second example uses the UNLOAD * command to delete two sets of firmware 
that are active simultaneously. 


>NET>unload * 


Requesting 'ppc82xx' to delete Itself................ PASSED 
Requesting 'servers' to delete Itself................ PASSED 
>NET> 


5.1.25 VERSION 


Syntax 


VERSION 
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Description 


The VERSION command displays the build date and revision number of the 
Wind River ICE SX firmware. 


Example: 
>NET>version 


KR KKK KKK KK KKK KKK KKK KKK KKK KK KKK KKK KKK KKK KK KKK KKK KKK KKK KK KKK KKK KKK EK 


Wind River ICE Ethernet Controller 
Copyright © Wind River Systems, Inc. 1999-2004. All rights reserved 


KR KKK KKK KKK KK KKK KKK KK KK KKK KKK KKK KKK KK KKK KKK KKK KKK KKK KKK KKK KKK KKK EK 


Firmware Type BSP Version 2.0a Created On: Oct 22 2004 16:07:17 


os version = V2.5.0 
REPC version = V2.5.0 
NA version = V4.0.5 
>NET> 
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